Professional Documents
Culture Documents
Control of Major Hazards
Control of Major Hazards
see Annexes 5 and 10), but it can also be more clearly displayed in the form of area-
specific risk. HSEs publication R2P2
(ref 13)
proposed a societal risk criterion (a 1 in
5000 chance per annum of an event causing 50 fatalities). HSE has since proposed a
more complex formulation and gone on to develop a ranking technique based on it,
though there is not yet general agreement over how it can be applied to all hazardous
sites. Clearly further research work is needed but we believe a rudimentary method of
estimating societal risk agreed now between parties is more important than academic
perfection. Refinement can come later. We understand that HSE intends to take this
work forward as part of an agreement between ministers following the CD212
consultation. We believe that in going forward with the revisions to the planning
system around major hazard sites, the boundaries of acceptability of societal risk
need to come to public debate and a public consensus needs to be developed.
114 Another difficulty is that there is no clear basis in law for taking into account
societys aversion to multiple fatality events (known as scale aversion) when
conducting a numerical risk assessment or enforcing risk reduction measures, but
HSEs policy is to reflect societal risk when making judgements about whether
measures are grossly disproportionate in relation to what is reasonably practicable.
While such aversion is not measurable in a literal sense, the debate about whether,
and to what extent, scale aversion should be introduced has run for some time.
Guidelines are needed on what weighting to give to more severe incidents to allow
practical application of societal risk. HSE advises that this issue is being pursued as
part of its ongoing work on societal risk, and we encourage HSE to conclude this
work as soon as practicable.
Recommendation 14 We recommend that HSE should bring together key
stakeholders and experts in the planning system (planning authorities, developers,
operators, regulators, risk assessment specialists) with a view to reaching agreement
as early as possible on:
M the way societal risk is measured and assessed;
M the data sources required for assessment purposes;
M the acceptability criteria for societal risk values around particular sites; and
M a suitable weighting factor for more serious, less frequent events (scale aversion).
34
22
FN curves are a means of plotting, normally on a logarithmic scale, the frequency (F) of
a fatal incident against the numbers of people (N) who may be killed in such an incident.
Applying land use planning controls to gasoline pipelines
115 While there is no suggestion that the large gasoline pipelines which supplied the
Buncefield site directly contributed to the major incident, there is an anomaly relating
to regulation of such pipelines which we consider now needs rectifying. Under the
Pipelines Safety Regulations 1996 (PSR) gasoline pipelines are subject to the same
general duties as all other pipelines, covering design, construction and installation,
operation, maintenance and decommissioning. However, they are excluded from the
additional duties for pipelines conveying fluids with a major accident hazard
potential. Consequentially, there are no requirements to produce an emergency plan
for gasoline pipelines nor to set land use planning zones around them. 35
Figure 9 Privately
operated refineries,
pipelines and terminals in
Britain. Note that some
of the terminals are
currently not operating
(eg Buncefield)
116 We understand that when PSR was enacted, HSE intended gasoline pipelines to
be subject to the additional requirements but this has not happened. Subsequent
research commissioned by HSE showed that although the levels of risk were low, the
potential consequences of an accident were very serious and confirmed that gasoline
pipelines should be treated as presenting a major accident hazard potential.
117 We conclude that PSR should be amended so that gasoline pipelines are subject
to land use planning and emergency planning controls, ie the sorts of controls
around other major hazard installations should apply in relation to development
near pipelines. Recommendation 15 addresses this aspect. We understand that HSE
is now taking this work forward and we welcome this initiative and encourage its
completion.
Recommendation 15 HSE should take necessary steps to amend the Pipeline Safety
Regulations with the aim of extending land use and emergency planning controls
(and other suitable regulatory protections if necessary) to major pipelines carrying
gasoline (petrol).
Public understanding
118 The basis on which HSE advises planning authorities was published in 1989 in
a discussion document entitled Risk criteria for land use planning in the vicinity of
major industrial hazards.
(ref 9)
There has since been a fundamental review in 1998
and consideration given to how to implement the conclusions of that review (see
Annex 9). It was not until 2007 and the issue of CD211 that HSE first set out its
policy objectives and principles on land use planning.
36
Figure 10 A large smoke
clouds hangs over the
north-eastern city of
Enschede. A fireworks
warehouse near the city
centre exploded on
13 May 2000, killing 23
people.
119 For those ultimately affected, namely site operators and local communities,
the basis on which land use planning decisions are reached can be difficult to
understand. We therefore call on those responsible for revising the system in line
with our recommendations to produce suitable technical guidance on how
decisions should be reached by the planning community. Notwithstanding the
technicalities that will inevitably have to be managed in determining planning
applications, the technical guidance should be comprehensible to a lay audience.
Recommendation 16 We recommend that HSE should review, update and publish
documentation on the process for handling land use planning risk assessments
around major hazard sites by local authorities, and the main contributors to the
decision-making process. The resulting publication should be capable of being
understood by a lay audience.
Local planning authority resources
120 In moving to the revised system called for in this report the local planning
authority will be required to take a much more transparent lead in the planning
application decision-making process. Support from emergency responders and
other key stakeholders is envisaged as being made available, and much more input
from the site operator is also called for. The Competent Authority is also asked to
provide expert guidance on the operation of the system and to see that it functions
properly. Nonetheless we foresee that for many if not all planning authorities there
will need to be a significant increase in resources and expertise available for it to
manage the planning process effectively and consistently. In Recommendation 17
we ask for due consideration to be given to this vital aspect.
Recommendation 17 Local planning authorities and the administrations
responsible for them should ensure the necessary expertise and other resources are
available to implement the revised planning system around major hazard sites, as
well as management systems to ensure maintenance of competencies, monitoring,
audit and review of the planning systems in their authority.
Application to major hazard sites
121 We commissioned work to demonstrate what a feasible risk-based system
might look like. An important aim of this commission was to present a model
system to the lay reader who until now has had to manage with rather abstract
descriptions. We also wanted to have some tangible indicators of the advantages
and disadvantages of a QRA-based system that could be consistently applied to all
major hazard sites compared to the status quo where a simplified risk approach is
applied at flammable storage sites. The work included some preliminary risk
analysis based on a part of the Buncefield site (the model site), primarily to gain a
better understanding of the issues associated with the quantification of the risk
posed by such a site. The scope of work is described in Annex 10, together with
the detailed results. We asked to see a methodology that would enable a QRA to
be carried out which would give predictions for both individual and societal risk,
identifying the major uncertainties in the analysis.
122 Aware that other countries subject to the Seveso Directive, such as the
Netherlands and Belgium, adopt a quantified approach to determine the risks from
flammable storage sites we also asked for the methodology used for risk
assessment and development control in the Netherlands to be applied to the model
site. We also asked for a review of the predictions in order to consider whether a 37
methodology based on risk rather than a mixture of risk and hazard could
potentially be used in the UK for future land use policy around all major hazard
sites.
123 The key success criteria are whether the model system is responsive to
changes in risk on and off site, whether it can incorporate societal risk in addition
to risk-based land use planning zones (as are currently produced by the simplified
risk approach), and whether the system would be affordable. The outcome of the
work appears to meet the criteria and strengthens our call for work to begin
without delay to develop a consistent risk-based system for use throughout the
major hazard sector in Britain.
124 The work demonstrates that it is possible to carry out a QRA of a large
petroleum storage facility and generate individual and societal risk predictions
reasonably quickly and without significant expense despite the uncertainties. The
current system for land use planning in Britain is based either upon the simplified
risk approach or QRA. This hybrid approach has a number of disadvantages as we
have pointed out. It would be possible to extend the QRA approach to all types of
major hazard site and thereby develop a land use planning system which is
consistently based on risk. A move to a universal QRA approach would be less
straightforward than the simplified risk assessment approach but it would remove
many of the undesirable features of the current system. It would also make the
system consistent across Britain. Such systems, where the QRA methodology is
defined by the regulator and the analysis is carried out by the site operator, are
currently operated in the Netherlands and Belgium.
125 To consider societal risk, the population within the vicinity of the site that is
exposed to the individual risk of fatality has to be considered. We are drawn to the
approach in the Netherlands and Belgium where regional public authorities and
38
Figure 11 Smoke rises
above Enschede. This
picture was taken at 90
o
from the viewpoint in
Figure 10. Both pictures
illustrate the density of
residential buildings
around the fireworks
warehouse
emergency services, operators and others consider new developments subject to
some absolute guidelines set by the national regulator. Risk contours are developed
by the site operators using actual site conditions processed in accordance with a
methodology set by the national regulator. Off-site conditions and types of
vulnerable populations are incorporated into the data provided for decision
making.
126 The overall societal risk from a single installation can be broken down to
show the main contributors to societal risk both in terms of the source of risk and
the receptor of risk (the people and/or buildings that could be affected by the
various hazard scenarios). Annex 10 shows the main societal risk contributors
derived from the various hazard sources. The breakdown of the data in terms of
receptors shows which measures to reduce the effect on the target feature would be
most effective. There is obvious scope to calculate the most effective means, with
due regard to cost, to reduce societal risk. Societal risks can also be added together,
so the overall societal risk from all the major hazards within a local authority area
could be determined and the local planning authority would be able to see the
effect on the societal risk over a period of time due to changes in both the
hazardous sites and even small changes in the population in the vicinity of these
sites. This would enable better spatial planning than is possible on information
available within the current system.
Implementation and priorities
127 In paragraph 88 we set out consistency of assessment of risk as our guiding
principle. To achieve it we have identified a number of relevant issues and made
recommendations. Overall it moves in the direction of a more individualised
approach to sites to identify the risks they present in a way that is more closely
related to actual circumstances.
128 We say above that we expect work to begin on revising the land use planning
system without delay and in parallel with the wide review called for in
Recommendation 1. We do recognise and commend the work done so far by HSE
in responding to the land use planning issues raised at Buncefield though more
needs to be done. We also recognise that the frequency data for vapour cloud
formation and ignition and over-pressure propagation in open flammable clouds are
uncertain. For the present, until the explosion mechanism work yields results, the
uncertainties can be managed in the same way that they are currently managed, eg
by using statistical outliers, sensitivity analyses and conservative assumptions in the
event frequency data. Sensitivity analysis uses a range of failure event frequency
data to test the assumptions behind the ones used in the risk calculations.
129 The explosion mechanism of the hazard of open flammable cloud explosions
is only one new aspect to be incorporated in future revisions of the scenarios that
feed the risk assesments. Revisions to all the scenarios that feed risk assessments
need to be undertaken. In addition the new consultation distances applied by HSE
to flammable storage sites are only applied to new developments. The impact of the
Buncefield incident on the risks at and around existing sites needs to be viewed
afresh. In the covering note to CD212
(ref 3)
HSE suggested there are already some
sites to which HSE could give priority treatment as the current system is overhauled
and agreed methodologies for new risk assessment approaches developed. The
Competent Authority will need to agree with COMAH operators and planning
authorities a programme of reviews of the sites of greatest concern, with clear
timescales against which progress can be measured and reported.
39
130 Account should also be taken of the impact of the measures that we call on in
our reports to the risks of a major incident as we believe the risks will reduce
significantly as the improved controls are applied.
131 We also expect the ALARP
23
(risks as low as reasonably practicable) risk
threshold to change as a result of what we learn from Buncefield. In other words,
measures that would perhaps have been deemed unreasonable in terms of the cost of
achieving a risk reduction may come into the scope of the ALARP condition in the
light of a revision to the worst-case scenarios after Buncefield, accounting for open
flammable cloud explosions and multi-tank fires. This needs to be considered for the
major hazards sector as a whole. It is not uncommon for operators with duties
under safety and environmental legislation to see the risk threshold under the
ALARP principle as a ceiling, the point at which they may safely stop seeking
further improvements. In fact the ALARP threshold is the floor on which
dutyholders need to stand, the starting point for best practice that is rightly
expected by the public and those who might be affected by the major hazard risks
created by the site.
Recommendation 18 The Competent Authority should agree a priority programme
with site operators and planning authorities for assessing societal risk at sites of
identified concern using the risk assessment methodologies developed in line with
our recommendations. Account should also be taken whether the ALARP threshold
has been raised due to considering previously unaccounted hazard scenarios.
132 Input to planning around major hazard sites under the system that we favour
will be wider than from HSE alone. Quite apart from the critical new role for
planning authorities and operators, guidance needs to be developed on how to use
the criteria relating to risk contours, and societal risk indicative criteria when an
acceptable approach and methodology for using societal risk have been devised. The
Competent Authority will need to set the standard for what to do and for the
criteria, while leaving the decisions to those affected. This is not a case of the
regulator standing back from difficult situations. The Competent Authority will
determine what needs to be provided and by whom to operate the system. The
Competent Authority will also check that the system is operating as intended.
133 The Competent Authority will also have to decide how it will react, within its
statutory role, to societal risk anomalies that come to light in the application of the
revised system and there may well be lessons in how the French, Belgians and Dutch
have adapted their systems to compensate for unacceptable societal and
environmental risk at existing installations in the light of applying new knowledge
or invention.
134 What are the potential downsides of our preferred system? A risk-based
approach is unlikely to significantly reduce the planning contours without the
improvements to the control measures we call for being carried out in practice.
For example, under the method adopted for the analysis that produced a model of a
risk-based planning system (see Annex 10) it was shown that the Northgate Building
was a significant contributor to societal risk at Buncefield. Modelling the Northgate
building so as to be further away from the site showed how the societal risk could
be lowered. In reality, under a risk-based system, it might be practicable to reduce
societal risk by improving the risk control measures (on- or off-site, or both).
40
23
The ALARP principle is further explained in Annex 5 (in the section QRA applications
of relevance to land use planning around major hazard sites).
41
Figure 12 A view of the
smoke plume at the
height of the Buncefield
fire as seen by police
maintaining the cordon in
the Leverstock Green area
of Hemel Hempstead.
Leverstock Green is one
of the nearest residential
areas to the Buncefield
depot and many people
were evacuated
135 A key disadvantage will be in the period of transition to a revised system
which will have significant implications for central and regional government and
industry. To illustrate the difficult questions to be faced, eg on retrospection and
interim application (with, as yet, incomplete tools), one need only look at
Recommendation 3, which calls for a broad economic case including costs to the
industry and wider society to be factored in. These will take some time and
intellectual effort to determine, and the obvious question will be what do we do
in the meantime, or do we wait? On the subject of retrospection (which we have
referred to, eg in paragraphs 2930 and 126) we wish to make it clear that we are
not calling for the bulldozing of swathes of perimeter developments or
decommissioning of major hazard sites. We are looking for the Competent
Authority, COMAH operators and planning authorities to agree what are the
priorities for action when factoring in societal risk, and to make targeted and
proportionate responses and maintain public confidence.
136 Recommendation 13, which calls for reforms to the management of the
decision-making process, illustrates the same issue. Some two and a half years
after Buncefield progress now lies in confronting the difficulties and not being
deterred by them. While we have addressed the questions of the scope of
application, the pace of progress and what to do during an interim phase of
several years, we will greatly value the commitment now of CLG and relevant
ministers of the devolved administrations, and HSE in particular to press ahead
on a number of fronts in the interests of balancing the necessary pace of progress
with technical and resourcing factors.
42
43
Annex 1
Terms of reference
This annex sets out the eight terms of reference for the Investigation and explains the
progress that is being made towards accomplishment of each of them.
1 To ensure the thorough investigation of the incident, the factors leading up to
it, its impact both on and off site, and to establish its causation including root
causes
The Board has published three progress reports from the Investigation Manager
between February and June 2006. These were followed by the Boards initial report
on 13 July 2006, which summarised the investigation to date and set out the Boards
main areas of concern. The reports have revealed the main facts of the incident, but
have not speculated on why control of the fuel was lost.
The explosion mechanism, ie the means by which unexpectedly high over-pressures
were generated, is subject to significant further investigation. An advisory group was
appointed to make recommendations to the Board on whether and what further work
could be undertaken in this regard see term of reference 5.
The criminal investigation is pursuing all reasonable lines of inquiry into the facts and
causes of the incident to enable the Competent Authority (HSE and the Environment
Agency) to take a view on legal proceedings.
2 To identify and transmit without delay to dutyholders and other appropriate
recipients any information requiring immediate action to further safety
and/or environmental protection in relation to storage and distribution of
hydrocarbon fuels
The Competent Authority issued a Safety Alert to around 1100 COMAH dutyholders
on 21 February 2006. Special attention was paid to 108 fuel depot owners storing
COMAH quantities of fuel in Great Britain, seeking a review of arrangements for
detecting and dealing with conditions affecting containment of fuel. Most dutyholders
responded to the alert by the Easter deadline. Meanwhile, the Competent Authority
visited all 108 depots to follow up the alert. An interim report was published on
13 June 2006 and is available at www.hse.gov.uk/comah/alert.htm.
The Environment Agency issued further advice to its inspectors to investigate
secondary (bunding) and tertiary (drains and barriers) containment at depots in
England and Wales in response to the second progress report.
The Environment Agency continues to monitor the effects of Buncefield on the
surrounding environment. Any changes picked up during monitoring will be reported
on its website, www.environmentagency.gov.uk. The initiative is being handled
separately for Scotland by the Scottish Environment Protection Agency, with joint
inspections undertaken with HSE covering primary, secondary and tertiary
containment, and management systems.
On 16 June 2006 investigators served two Improvement Notices on the
manufacturers of the high level alarm switch installed on Tank 912, having identified
a potential problem at other sites related to the setting of the switch for normal
operations following testing. This was followed up by a Safety Alert from HSE on
4 July 2006 alerting operators relying on such switches of the potential problem.
The Chairman of the Buncefield Board wrote to the Chief Executive of the Health
Protection Agency on 3 July 2006 enquiring into progress with informing regional
resilience groups of early lessons learned from Buncefield, focusing on public
health issues in the immediate aftermath of a major airborne incident, following up
with a meeting December 2006.
The Buncefield Investigation Manager wrote to HSE on 30 August 2007 with
observations on the reliability of servo level gauging systems. HSE subsequently
held discussions with the Process Safety Leadership Group on this subject and
provided an update report to MIIB on 31 October 2007.
3 To examine the Health and Safety Executives and the Environment Agencys
role in regulating the activities on this site under the COMAH Regulations,
considering relevant policy guidance and intervention activity
Work is progressing steadily on both parts of the review, concerning respectively
HSEs and the Environment Agencys prior regulatory activities at Buncefield. The
full findings of the review will be incorporated into the Boards final report (see
term of reference 8). Immediate important lessons from the examination of the
Competent Authoritys prior role have been incorporated as appropriate into the
lessons learned programme under term of reference 5.
4 To work closely with all relevant stakeholders, both to keep them informed
of progress with the Investigation and to contribute relevant expertise to other
inquiries that may be established
The ongoing impact on residents and businesses of the Buncefield incident has been
reported in the three progress reports and in the initial report in which, in Part 2,
the Board set out its main areas of concern. The Board has maintained an active
interest in releasing as much new information as possible to the community and its
representatives, such as the local MP Mike Penning, to assist in understanding the
events of 11 December 2005, and to maintain public confidence that progress is
being made with the Investigation.
As has been reported previously, residents and businesses continue to show
remarkable resilience in the difficult aftermath to the Buncefield incident. Dacorum
Borough Council in particular, but also St Albans and Hertfordshire Councils,
have performed extremely effectively in very difficult circumstances, and have
supported the Board in its engagement with residents and businesses, as has
Mike Penning MP.
The Board has also kept key Government stakeholders informed of the
Investigations progress, and has maintained its interest in developments that have
taken place since Buncefield to help manage the aftermath and support a return to
normality for residents and businesses.
The Board has engaged with all the public sector agencies involved in the
emergency response to Buncefield and has met with a number of the key agencies,
particularly the Category 1 (Gold) responders. This is not an issue in which the
Board has primary responsibility, but has outlined its conclusions and
recommendations within the contents of its sixth report Recommendations on the
emergency preparedness for, response to and recovery from incidents.
The MIIB continues to meet from time to time with residents, businesses, agencies,
government departments and public representatives to inform them of progress.
44
5 To make recommendations for future action to ensure the effective management
and regulation of major accident risk at COMAH sites. This should include
consideration of off-site as well as on-site risks and consider prevention of
incidents, preparations for response to incidents, and mitigation of their effects
The Boards fifth report (March 2007), made recommendations for the design and
operation of Buncefield-type sites. HSE convened an industry-chaired task group (the
Buncefield Standards Task Group) which included the Environment Agency and the
Scottish Environment Protection Agency, to also consider design and operation issues
in parallel with the Boards work. This initiative was welcomed by the Board in its
report.
The Boards sixth report (July 2007) made recommendations for the emergency
preparedness for, response to and recovery from incidents. The work in producing the
recommendations contained within the report was supported by an immense amount
of work undertaken by other agencies such as Hertfordshire Resilience, Hertfordshire
Fire and Rescue Service, and the Health Protection Agency. With these
recommendations, the Board joined together the many strands of this subject,
including issues concerning support to communities and businesses in the aftermath
of an extreme incident.
An expert group was appointed in 2006 to give advice to the Board on possible
explosion mechanisms of relevance to Buncefield. A report by the advisory group was
published in August 2007 as the Boards seventh report. It recommended further
investigations leading to a decision on whether full-scale research is required. The
further investigations are currently ongoing.
HSE completed its initial work on changes to land use planning advice and issued a
revised policy for large petrol storage sites in December 2007. The outcomes of
consultation on societal risk around onshore non-nuclear major hazard installations
was published in January 2008. The Board set out its own views to both consultation
documents (see www.buncefieldinvestigation.gov.uk).
This report, the Boards eighth, sets out the Boards considered position for securing
improvements to the system for land use planning around major hazard sites.
6 To produce an initial report for the Health and Safety Commission and the
Environment Agency as soon as the main facts have been established. Subject
to legal considerations, this report will be made public
The Boards initial report was published on 13 July 2006.
7 To ensure that the relevant notifications are made to the European
Commission
A report from the Environment Agency and HSE was made to the European
Commission on 10 March 2006. Subsequently, the Environment Agency declared
Buncefield a major accident to the environment (MATTE), and the Competent
Authority reported this to the European Commission in July 2006.
8 To make the final report public
The timing for the publication of the final report remains uncertain and is linked to
progress on the main terms of reference and to any decision on any criminal
proceedings that might be considered.
45
Annex 2
Members of the independent Board
The Rt Hon Lord Newton of Braintree has been a life peer since 1997 after
spending 23 years as a Conservative Member of Parliament for Braintree, Essex.
From 1982 to 1988 he held ministerial positions at the Department of Health
and Social Security. In 1988 he joined the Cabinet as Chancellor of the Duchy of
Lancaster and Minister at the Department for Trade and Industry. He then held
the post of Secretary of State for Social Security from 1989 to 1992 when he was
appointed Leader of the House of Commons, which he held until 1997. In 2002
he chaired the Committee that reviewed the operation of the Anti-terrorism,
Crime and Security Act 2001.
Professor Dougal Drysdale is one of the leading international authorities in fire
safety engineering. He was the Chairman of the International Association of Fire
Safety Science until September 2005 and is currently the editor of the leading
scientific journal in the field, Fire Safety Journal. His wide range of research
interests includes the ignition characteristics of combustible materials, flame
spread and various aspects of fire dynamics. He is a Fellow of the Royal Society
of Edinburgh and a Fellow of both the Institution of Fire Engineers and the
Society of Fire Protection Engineers.
Dr Peter Baxter is a Consultant Physician in occupational and environmental
medicine at Cambridge University and Addenbrookes Hospital, Cambridge. In
the past, he has advised the government on the impacts on public health relating
to air quality standards, major chemical incidents, natural disasters and climate
change.
Taf Powell is Director of HSEs Offshore Division. He graduated in Geology and
Chemistry from Nottingham University. His oil field career has been split
between working in the UK and abroad in offshore exploration and development
and regulation of the sector in licensing, well operations, policy and safety
regulation. In 1991 he joined HSEs Offshore Division from BP and started work
to develop the new offshore regulatory framework, one of Lord Cullens
recommendations following his inquiry into the Piper Alpha disaster. As HSEs
Operations Manager, based in Aberdeen, he then led inspection teams and well
engineering specialists responsible for enforcing the new regulations until 2000
when he took up his current role.
Dr Paul Leinster is Director of Operations at the Environment Agency. Up until
March 2004 he was the Director of Environmental Protection, having joined the
Agency in 1998. Before this he was the Director of Environmental Services with
SmithKline Beecham. Previous employers also include BP International, Schering
Agrochemicals and the consultancy firm Thomson-MTS where he was Managing
Director. Paul has a degree in Chemistry, a PhD in Environmental Engineering
from Imperial College and an MBA from the Cranfield School of Management.
He has worked in the health and safety and environmental field for 30 years.
David Ashton is Director of HSEs Field Operations North West and
Headquarters Division. He joined HSE in 1977 as an inspector in the west of
Scotland where he dealt with a wide range of manufacturing and service
industries, including construction, engineering and the health services. In 1986 he
joined Field Operations HQ to deal with machinery safety. He then held the post
of Principal Inspector of manufacturing in Preston for two years, before being 46
appointed as a management systems auditor to examine offshore safety cases in the
newly formed Offshore Division. In 1993 he became Head of HSEs Accident
Prevention Advisory Unit, looking at the management of health and safety in
organisations. Between 1998 and 2003 David was HSEs Director of Personnel,
before being appointed to his current position.
47
Dr Graham
Green-Buckley
Regulatory review
Environment
Agency lead
Bob Woodward
Primary
Investigation lead
Paul Woodhouse
Regulatory review
HSE lead
Phil Kemball
MIIB Secretary
Dominic
Pritchard
Legal advisor
to the Board
David Ashton
HSE
representative
Dr Paul Leinster
Environment
Agency
representative
Dr Peter Baxter
Health
expert
Professor
Dougal Drysdale
Fire Safety
Engineering
expert
Taf Powell
Investigation
manager
Lord Newton
Chair
MIIB
Annex 3
The COMAH regulatory regime
Part 1: Regulatory framework for high-hazard sites
[reproduced from Initial Report Annex 8]
1 The regulatory framework for sites such as Buncefield, which present potential
major accident hazards, comprises requirements imposed on the site operators
under both health and safety and environmental legislation, complemented by the
requirements of planning law. In particular, the Control of Major Accident
Hazards Regulations 1999 (COMAH) apply.
Health and safety law
2 Operators in the process industries are subject to the requirements of the
Health and Safety at Work etc Act 1974 (the HSW Act) and the Management of
Health and Safety at Work Regulations 1999 which require, respectively, safety
policies and risk assessments covering the whole range of health and safety risks.
Control of Major Accident Hazards Regulations 1999 (COMAH)
3 COMAHs main aim is to prevent and mitigate the effects of those major
accidents involving dangerous substances, such as chlorine, liquefied petroleum gas
and explosives which can cause serious damage/harm to people and/or the
environment. The COMAH Regulations treat risks to the environment as seriously
as those to people. They apply where threshold quantities of dangerous substances
identified in the Regulations are kept or used. There are two thresholds, known as
lower-tier and top-tier. The requirements of COMAH are fully explained in A
guide to the Control of Major Accident Hazards Regulations 1999 (COMAH).
Guidance on Regulations L111.
(ref 15)
4 The COMAH Regulations are enforced by a joint Competent Authority
comprising HSE and the Environment Agency in England and Wales, and HSE and
the Scottish Environment Protection Agency (SEPA) in Scotland. Operators will
generally receive a single response from the Competent Authority on all matters to
do with COMAH. The Competent Authority operates to a Memorandum of
Understanding, which sets out arrangements for joint working.
5 The COMAH Regulations require operators of top-tier sites to submit written
safety reports to the Competent Authority with the purpose, among others, of
demonstrating that major accident hazards have been identified and that the
necessary measures have been taken both to prevent such accidents and to limit
any consequences. Operators of top-tier sites must also prepare adequate
emergency plans to deal with the on-site consequences of possible major accidents,
and to assist with off-site mitigation. Local authorities for areas containing top-tier
sites must prepare adequate emergency plans to deal with the off-site consequences
of possible major accidents, based on information supplied by site operators.
6 The COMAH Regulations place duties on the Competent Authority to have in
place a system of inspections for establishments subject to the Regulations, and to
prohibit the operation of an establishment if there is evidence that measures taken
for prevention and mitigation of major accidents are seriously deficient. The
Competent Authority also has to examine safety reports and inform operators
about the conclusions of its examinations within a reasonable time period. 48
7 The inspection plan for a particular establishment is drawn up by inspectors
from the Competent Authority based on previous interventions at the site and on
information gained from the assessment of the safety report. The inspection
programme requires input from a range of inspectors with specialist knowledge and
identifies and prioritises issues. The focus of the programme is to ensure that the key
risk control measures for preventing and mitigating major hazards are maintained.
8 The adequacy of this process and its application at Buncefield by HSE and
Environment Agency inspectors is subject to a review under term of reference 3.
Environmental legislation
9 Some of the establishments regulated under the COMAH Regulations are also
regulated by the Environment Agency and SEPA (the Agencies) under the Pollution
Prevention and Control Act 1999 (PPC).
10 While the purpose of the COMAH Regulations (the prevention of major
accidents) differs from that of PPC, the means to achieve them are almost identical.
They require industry to have good management systems to control risk. PPC
includes a specific duty to prevent and mitigate accidents to the environment which
is complementary to the main COMAH duty. The Agencies manage this overlap
between their different regimes following the principle that accident prevention
work on COMAH sites is generally more significant because of the greater risks.
Supporting guidance and standards
11 The legal requirements are supported by a large body of guidance and
standards that set out recognised good practice in the control of major accident
hazards. This includes national and international standards, industry guidance and
guidance published by the Competent Authority. Examples of the latter are
Reducing error and influencing behaviour HSG48,
(ref 16)
Successful health and
safety management HSG65 (Second edition)
(ref 17)
and Containment of Bulk
Hazardous Liquids at COMAH Establishments Containment policy Supporting
Guidance for Secondary and Tertiary Containment.
(ref 18)
Land use planning
12 The land use planning aspects of the Seveso II Directive are given effect in the
UK by the Planning (Hazardous Substances) Regulations 1992, as amended in
1999. Under these Regulations the presence of hazardous chemicals above specified
thresholds requires consent from the hazardous substances authority, usually the
local planning authority. HSE is a statutory consultee on such occasions. The role
of HSE is to consider the hazards and risks which would be presented by the
hazardous substances to people in the vicinity, and on the basis of this advise the
hazardous substances authority whether or not consent should be granted. HSE
will also supply a consultation distance around the site. Any future developments
in these zones require HSE to be consulted.
13 The aim of health and safety advice relating to land use planning is to mitigate
the effects of a major accident on the population in the vicinity of hazardous
installations, by following a consistent and systematic approach in providing
advice on applications for planning permission around such sites.
14 Historically, HSE has based its land use planning advice on the presumption
that site operators are in full compliance with the HSW Act. Section 2 of the Act
places a duty on an employer to ensure, so far as is reasonably practicable, the
health and safety of his employees. There is a corresponding duty in section 3 to
ensure, so far as is reasonably practicable, that others (including the public) are not 49
exposed to risks to their health and safety. These duties are goal-setting and
operators are expected to determine the most appropriate means to comply with
them, without the need for detailed approval from HSE.
15 Under the General Development Procedure Order 1995, both HSE and the
Environment Agency are statutory consultees for:
M the development of a new major accident hazard site; or
M developments on an existing site which could have significant repercussions on
major accident hazards; or
M other developments in the vicinity of existing establishments, where the siting
or development is such as to increase the risk or consequences of a major
accident.
Part 2: Planning regulatory regime in Britain
Background
16 Regulation of major hazard sites under the Control of Major Accident Hazards
Regulations (COMAH) and other health and safety law is complemented by the
requirements of planning law.
17 Under the Planning (Hazardous Substances) Act 1990 and associated
Regulations, the presence on, over or under land of a hazardous substance in
excess of a specified amount (controlled quantity) requires consent from the
hazardous substances authority, usually the local planning authority (LPA). The
Act empowers the Secretary of State (for Communities and Local Government) to
specify the hazardous substances and their controlled quantities. Flammable
materials such as petroleum spirits and aviation fuels require consent in quantities
above 5000 tonnes. The amounts present at Buncefield would significantly exceed
this level.
18 HSE establishes a consultation distance, made up of three zones (to become
four zones as a result of changes recently introduced by HSE for new planning
applications), around hazardous sites based on the substances consent granted.
LPAs are required to consult HSE (and others, including the Environment Agency
or the Scottish Environment Agency (SEPA)) before future development takes place
within consultation zones so that HSE can advise on appropriateness of a proposed
development and minimise off-site risk to members of the public. LPA consultation
is required by the Town and Country Planning (General Development Procedure)
Order 1995 (as amended). Advice on planning applications is considered on a
case-by-case basis.
19 The decision on whether the proposed development should go ahead is a
matter for the LPA, not HSE. Where the LPA proposes to go against HSEs advice
that permission should be refused, it is required to give HSE an opportunity to ask
the relevant minister in England or Wales to call-in the application. Called-in
applications are very rare. In Scotland a decision to go against is automatically
advised to ministers who may decide to review the application.
20 Land use planning around major hazard installations in Britain has its origins
in the reports
(refs 1921)
of the Advisory Committee on Major Hazards (ACMH)
which was set up following the explosion at Flixborough, the third report in
particular. ACMH recognised the importance of providing planning authorities
50
with a source of safety advice prior to the establishment of new major hazard
installations and, subsequently, on further development in the vicinity. Five years
after the final ACMH report, HSE produced a separate document setting out its
approach to land use planning.
(ref 9)
Various reports had been produced about
HSEs approach to giving land use planning advice as a result of an internal
Fundamental Review of Land Use Planning; however, the 1989 document remains
the key published document covering the policy on giving land use planning
advice.
Legal basis for HSEs involvement in land use planning around major hazard
sites
21 Over the years, the legal basis for giving the advice has been set out in acts,
regulations and departmental guidance. These include:
M the Notification of Installations Handling Hazardous Substances Regulations
1982;
M the Planning (Hazardous Substances) Act 1990;
M the Planning (Hazardous Substances) Regulations 1992;
M the Town and Country Planning (General Development Procedure) Order
1995;
M the Planning (Control of Major-Accident Hazards) Regulations 1999;
M Planning Control for Hazardous Substances DETR Circular 04/2000; and
M Hazardous Substances Consent A Guide for Industry DETR Sept 2000.
22 The current position is that the establishment of a new hazardous installation
requires Hazardous Substance Consent (HS Consent). HS Consent is a planning
matter and the responsibility of planning authorities, most usually local authorities
at district level or unitary authorities.
23 The planning legislation relating directly to hazardous substances prescribes the
controls on hazardous substances, their quantity and location, and the physical
state in which they are kept and used. However, planning controls on subsequent
development near to COMAH sites is general in nature and focused on other
aspects of controlling development. It can prove difficult to control those aspects
of development which might be significant when located near to COMAH sites.
Procedure for formulating planning advice
24 HSE must be consulted about HS Consent for new sites in accordance with the
Town and Country Planning (General Development Procedure) Order 1995 (the
1995 Order). Once a hazardous installation is established, HSE must be consulted
about development proposals nearby, also in accordance with the 1995 Order.
25 At the time of the Buncefield incident the procedure for giving advice relied on
the definition of three zones around the hazardous installation (conventionally
named inner, middle and outer). The zones are derived from a risk assessment
process applied to the installation as specified in the HS Consent. The risk
assessment may lead to risk-based zones where the likelihood (frequency) of a
particular level of harm is predicted from a representative set of hazardous events
and zones are set according to different likelihoods. This system is usually referred
51
to as quantitative risk assessment (QRA). In other cases the risk assessment may
lead to zones based on three hazard ranges (that is, to different levels of harm)
predicted from one or more hazardous events from the representative set
considered. This system implements a philosophy that was described by ACMH as
the protection concept.
26 In either case, these zones are usually shown on a map of the area around the
installation, which is produced by HSE and supplied to the planning authority (a
three-zone map). All proposed developments that require consultation with HSE
are allocated to one of four sensitivity levels, with 4 being the most sensitive and
1 the least sensitive. A go/no go decision matrix is used to determine the advice
according to the development sensitivity and the zone in which it is located.
24
27 Following a consultation exercise in 2007, HSE published its plans to extend
the outer consultation distance at large-scale petrol storage sites in Britain to
400 m. In addition, a new inner development proximity zone of 150 m radius is to
be incorporated within which HSEs planning advice will be more restrictive. The
revised interim policy will apply only to new planning applications and is intended
to be introduced in the summer of 2008.
52
24
PADHI HSEs land use planning methodology. See Annex 9.
53
Annex 4
Planning history of Buncefield site and neighbouring developments
[Reproduced from Annex 3 of Initial Report]
1 Planning permission was granted in 1966 to Shell Mex and BP Limited, Regent
Oil Co Limited, Mobil Oil Co Limited, and Petrofina (GB) Limited to develop 91
acres of land at Buncefield for the construction of a storage and distribution depot
for petroleum products. St Albans Rural District Council initially refused the
application on the grounds that it was an inappropriate development in the Green
Belt and would have a detrimental effect on the amenity of the locality. On appeal,
the Minister of Housing and Local Government granted permission subject to a
number of conditions relating to design of the site, tree planting and restrictions on
the size of office premises.
2 At the time that the terminal was built in 1968, the site was well screened by
hedges and trees, but there were about nine dwellings on the periphery of the site
to the north whose amenities were affected by the site, and a farm to the south.
One of the nine dwellings to the north was converted in 2000 to create five
separate properties. Since 1968 there has been general encroachment and
development of adjacent land. This can be seen on the map in Figure 13. The
majority of this building development took place during the period from the mid-
1960s to the early 1980s, comprising the construction or redevelopment of
residential properties and a number of schools and industrial premises to the west
of the site, all of which fell within a 3 km radius as shown on the map. Between
1990 and 2006, a few additional industrial premises were built around the site.
3 Dacorum Borough Council is the principal planning authority for the site, but
a small section to the north of Cherry Tree Lane falls to St Albans District Council.
4 The local planning authority decides whether developments can go ahead. But
arrangements have existed since 1972 for local planning authorities to obtain
consultee advice from HSE and its predecessors about the safety implications for
developments from risks associated with major hazards. Between 1991 and 2005,
28 applications were passed to HSE for advice relating to a variety of commercial
or residential developments around the Buncefield site. HSE advised against four
of these proposals and advised that seven others could be allowed subject to
certain conditions. As far as is known, the local authority followed HSEs advice
in these cases.
5 In addition to these specific developments on which HSE was a statutory
consultee, HSE is from time to time consulted on other matters. For example, HSE
was consulted on four local structure plan revisions.
6 The complex began operations in 1968 after a pipeline was constructed to link
two Shell refineries at Stanlow at Ellesmere Port in Cheshire and Shell Haven on
the Thames Estuary at Stanford-le-Hope in Thurrock. The depot operated
originally under licence given under the Petroleum (Consolidation) Acts 1928 and
1936. The Planning (Hazardous Substances) Act 1990 and subsequent statutory
provisions, the Planning (Hazardous Substances) Regulations 1992 (PHS
Regulations) and later the Planning (Control of Major Accident Hazards)
Regulations 1999 introduced new procedures for consent to be sought from the
hazardous substances authority to store hazardous substances.
54
0
0
.
5
1
0
.
2
5
M
i
l
e
s
A
M
a
p
t
o
s
h
o
w
a
l
l
b
u
i
l
d
i
n
g
d
e
v
e
l
o
p
m
e
n
t
s
b
y
t
y
p
e
b
e
t
w
e
e
n
m
i
d
1
9
6
0
'
s
a
n
d
2
0
0
5
w
i
t
h
i
n
a
3
k
m
r
a
d
i
u
s
o
f
t
h
e
B
u
n
c
e
f
i
e
l
d
S
i
t
e
.
B
u
n
c
e
f
i
e
l
d
S
i
t
e
C
o
n
s
u
l
t
a
t
i
o
n
D
i
s
t
a
n
c
e
3
k
m
r
a
d
i
u
s
1
9
6
0
s
-
1
9
8
0
s
I
n
d
u
s
t
r
i
a
l
1
9
6
0
s
-
1
9
8
0
s
N
e
w
R
e
s
i
d
e
n
t
i
a
l
1
9
6
0
s
-
1
9
8
0
s
I
n
f
i
l
l
R
e
s
i
d
e
n
t
i
a
l
1
9
6
0
s
-
1
9
8
0
s
S
c
h
o
o
l
s
1
9
6
0
s
-
1
9
8
0
s
L
e
i
s
u
r
e
1
9
8
0
s
-
1
9
9
0
s
I
n
d
u
s
t
r
i
a
l
1
9
8
0
s
-
1
9
9
0
s
N
e
w
R
e
s
i
d
e
n
t
i
a
l
1
9
9
0
s
I
n
d
u
s
t
r
i
a
l
1
9
9
0
s
N
e
w
R
e
s
i
d
e
n
t
i
a
l
1
9
9
0
s
L
e
i
s
u
r
e
1
9
9
0
s
-
p
r
e
s
e
n
t
I
n
d
u
s
t
r
i
a
l
1
9
9
0
s
-
p
r
e
s
e
n
t
N
e
w
R
e
s
i
d
e
n
t
i
a
l
1
9
9
0
s
-
p
r
e
s
e
n
t
N
u
r
s
e
r
y
C
r
o
w
n
c
o
p
y
r
i
g
h
t
,
a
l
l
r
i
g
h
t
s
r
e
s
e
r
v
e
d
,
H
S
E
1
0
0
0
2
1
0
2
5
(
2
0
0
6
)
A
M
a
p
t
o
s
h
o
w
a
l
l
b
u
i
l
d
i
n
g
d
e
v
e
l
o
p
m
e
n
t
s
b
y
t
y
p
e
b
e
t
w
e
e
n
m
i
d
1
9
6
0
s
a
n
d
2
0
0
5
w
i
t
h
i
n
a
3
k
m
r
a
d
i
u
s
o
f
t
h
e
B
u
n
c
e
f
i
e
l
d
s
i
t
e
Figure 13 Developments within 3 km of the Buncefield site between 1966 and 2005
55
7 The consent identifies the hazardous substances and their location on site and
defines certain conditions of use such as maximum size, temperature and pressure
of storage vessels. Figure 16 contains some details of consents obtained for the
Buncefield depot. The consents for Shell UK Oil Limited have been included in
this table as they have not been revoked, although Shell no longer operates from
this site.
HSEs role in land use planning
8 HSEs specific role in land use planning is twofold:
M Under the PHS Regulations, the presence of hazardous chemicals above
specified threshold quantities requires consent from the local hazardous
substances authority, which is usually also the local planning authority. HSE is
a statutory consultee on all hazardous substances consent applications. Its role
is to consider the hazards and risks which would be presented by the
hazardous substance(s) to people in the vicinity, and on the basis of this to
advise the hazardous substances authority whether or not consent should be
granted. In advising on consent, HSE may specify conditions that should be
imposed by the hazardous substances authority, over and above compliance
with statutory health and safety requirements, to limit risks to the public (eg
limiting which substances can be stored on site, or requiring tanker delivery
rather than on-site storage). Hazardous substances authorities should notify
HSE of the outcome of all applications for consent, and where consent has
been granted should supply copies of the site plans and conditions.
M HSE uses the information contained in consent applications to establish a
consultation distance around the installation. This usually comprises three
zones or risk contour areas. The consultation distance is based on the
maximum quantity of hazardous substance(s) that the site is entitled to have
under its consent. HSE notifies the local planning authorities of all
consultation distances in their areas. The General Development Procedure
Order 1995 requires the local planning authority to consult HSE about certain
proposed developments (essentially those that would result in an increase in
population) within any consultation distance. HSE advises the local planning
authority on the nature and severity of the risks presented by the installation to
people in the surrounding area so that those risks are given due weight by the
local planning authority when making its decision. Taking account of the risks,
HSE will advise against the proposed development or simply note that it does
not advise against it.
9 HSEs approach to land use planning is set out in more detail in Annex 2 of
the first Progress Report.
(ref 22)
Some of this process is now being devolved to
certain local planning authorities.
10 The consultation distance represents the furthest distance at which HSE wishes
to be consulted about developments near hazardous installations/major accident
hazard pipelines. This does not mean that there is no risk beyond the consultation
distance, just that the predicted risks are sufficiently low that they need not be part
of a planning decision.
11 Within the consultation distance, HSE undertakes an assessment of the hazards
and risks from the installation and produces a map with three contours
representing defined levels of harm or risk which any individual at that contour
would be subject to, based on information relating to the hazardous substances
consent. The harm or risk to an individual is greater the closer to the installation.
The contours form three zones, with the outer contour defining the consultation
distance around major hazard sites. The local authority consults HSE on relevant
proposed developments within this consultation distance
12 When a planning application is received, HSE or the local planning authority
first identifies in which of the three zones the proposed development is located.
Secondly, the proposed development is classified into one of four sensitivity levels.
The main factors that determine these levels are the number of people at the
development, their sensitivity (vulnerable populations such as children, old people)
and the intensity of the development. With these two factors known, a simple
decision matrix is used to give a clear Advise Against or Do not Advise Against
response to the local planning authority, as shown in Figure 15:
13 More comprehensive guidance on the allocation of sensitivity levels is given on
the Planning Advice for Developments near Hazardous Installations website
(www.hse.gov.uk/landuseplanning/padhi.pdf).
56
Consultation distance
Inner zone:
Risk greater than 3 in 10 million
chances per year of receiving
a dangerous dose or worse (DD)
Middle zone:
> 1 in 1 million
chance per year
of a DD
Inner zone:
> 1 in 10 000
chance per year
of a DD
COMAH site
Figure 14 Consultation
distance and zones
Figure 15 Land use
planning sensitivity levels
and decision matrix
Level of sensitivity Development in Development in Development in
inner zone middle zone outer zone
1 DAA DAA DAA
2 AA DAA DAA
3 AA AA DAA
4 AA AA AA
Sensitivity level 1 Example Factories
Sensitivity level 2 Example Houses
Sensitivity level 3 Example Vulnerable members of society eg
primary schools, old peoples homes
Sensitivity level 4 Example Football ground/large hospital
DAA means Do not Advise Against the development
AA means Advise Against the development
57
History of the consultation distance around the Buncefield site
14 HSE has had arrangements with local planning authorities for consultation
around developments in the vicinity of major hazards since the early 1970s,
although it was not until the implementation of the Notification of Installations
Handling Hazardous Substances Regulations 1982 (NIHHS Regulations) in 1983
that HSE first received notification from Shell Mex and BP of the terminal as a
major hazard. A generic non-site-specific consultation distance of 250 m from the
boundary of the site was set for consultation purposes and the relevant local
planning authority was notified. At that time it was customary to issue a generic
consultation distance without performing a site-specific assessment. This
consultation distance was based upon the assumption that the main hazard was
from thermal radiation following a major fire within the bund.
15 In 1992 the site expanded and Mobil and Shell sent another notification and
application for consent to store certain amounts of flammable material. The
existing consultation distance was maintained at a generic 250 m from the site
boundary. There are no records of the technical assessments that were performed
when the local planning authority sought advice on developments within the
vicinity of the site, but early assessments were based then, as now, upon a pool fire
following loss of containment of a substantial quantity of flammable liquid.
However, for tanks that were bunded there was a continuing assumption that any
subsequent fire would be within the confines of the bund.
16 In 1996 a site-specific reassessment was performed based upon consented
amounts of flammable material, and the consultation distance was reduced from
250 m to 190 m. The original 250 m was set in the early days of HSE giving land
use planning advice, to ensure that all developments that might be advised against
would be subject to consultation. By 1996, technical policy and methodology had
been reviewed. In addition, three-zone maps were now being produced so that
development control advice could be given more quickly and efficiently. The new
policy assumed that the bund would not be able to contain the full contents of a
tank following a sudden, catastrophic failure. It was assumed that the bund
would be overtopped and the resulting pool fire would extend beyond the
confines of the bund.
17 In July 2001 another consultation distance was calculated due to an extensive
reassessment of the hazards from the site following the submission of a batch of
new consent applications from the oil companies. The regulations requiring
consent to store flammable substances were changed in 1999 to include additional
flammable materials. The consultation distance was reduced from 190 m to 185 m.
This was unchanged following a further consent application on 8 July 2005 from
BP. The presence of the additional material did not alter the main basis of the
calculation which assumed the worst-case event was the catastrophic failure of the
largest tank containing gasoline. The consultation distance was reduced slightly
owing to a slight change to the inputs in the model used to perform the
calculations. See Figure 17 for a representative plan of the site showing the
consultation distance since July 2001.
58
Some details of hazardous substances consents issued for the
Buncefield oil storage and transfer depot
Operator Hazardous Substances Consent applications
Texaco Limited 19 September 1983:* 10 571 tonnes motor spirit
Mobil Oil Co Limited 8 November 1983:* 17 650 tonnes petrol
Hertfordshire Oil 30 November 1992: 34 020 tonnes motor spirit
Storage Limited
18 October 1999: 15 314 tonnes kerosene
BP Oil UK Limited 18 November 1992: 17 650 tonnes gasoline in name of
Mobil Oil Co Limited
26 October 1999: 15 080 tonnes automotive petrol and other
petroleum spirits
21 October 2003: 15 200 tonnes automotive petrol and
10 522 tonnes petroleum products classified as dangerous for
the environment (most likely to be gasoline or diesel)
3 May 2005: 26 900 tonnes automotive petrol and
10 522 tonnes petroleum products classified as dangerous for
the environment (most likely to be gasoline or diesel)
British Pipeline 26 October 1999: 70 000 tonnes automotive petrol and other
Agency Limited petroleum spirits
Shell UK Oil Limited 19 September 1983:* 37 397 tonnes HFLs Class 4 and
42 561 tonnes kerosene and white oils
30 November 1992: 34 013 tonnes petroleum spirit and
39 000 tonnes diesel, gas oil and kerosene
1999: 33 000 tonnes motor spirit and 17 000 tonnes kerosene
* Note: The first applications for consent were in 1992, before then different arrangements were in
place, ie these were notifications under NIHHS and consent was not required.
Figure 16 Hazardous
substances consents issued
59
Consultation
distance
Boundary Way
Hertfordshire Oil
Storage Ltd (west)
Hertfordshire Oil
Storage Ltd (east)
Shell UK Oil Ltd
until April 2003.
Consent remains
British Petroleum
Oil UK Ltd
British Pipeline
Agency (south)
British Pipeline
Agency (north)
N
Inner zone:
closer than 120 m
Middle zone:
closer than 135 m
Outer zone:
closer than 185 m
Figure 17 Plan representing the hazardous substances consents and consultation area around
the Buncefield depot since July 2001 (for illustration only)
Annex 5
Hazard and risk and the application of QRA and dangerous dose or
worse to land use planning around major hazard sites
1 The study of risk uses a number of terms with specific meanings which can
vary to a degree from common usage. This annex provides a simple explanation of
their meanings in this context. The current definitive text on the subject is HSEs
Risk criteria for land use planning in the vicinity of major industrial hazards
1989.
(ref 9)
Hazard and risk
2 The word hazard means a situation with the potential to cause harm (injury or
death) but does not imply whether the likelihood of the harm being realised is high
or small. The adverse consequences to people arising from the loss of containment
from a tank of pressurised toxic gas or a large tank of flammable liquid are
examples. In contrast risk means the frequency or likelihood (probability) of a
harmful event such as injury or death from a major hazard incident.
Residual risk
3 The COMAH Regulations require the site operator to take all measures
necessary to prevent major accidents and limit their consequences to persons and
the environment. These measures can reduce the risk of an event occurring with
off-site consequences but cannot entirely eliminate it. The irreducible minimum
level of risk, having taken all necessary control measures, is known as residual risk.
Land use planning decisions need to take residual risk into account. The intention
is to control significant developments near to major hazard sites to avoid
undesirable increases in the numbers of people exposed to the residual risk from
the site.
Individual risk
4 This risk relates to the likelihood that a particular person might be harmed.
Such a person may be a named individual with known habits, or a typical
inhabitant of a house or a typical user of a leisure facility at a specified location.
To provide general application, typical cases are the ones of interest, though this
needs to be done with some care because of the wide variations in peoples habits
and vulnerability to harm.
5 Individual risk is expressed as the probability of a typical user of the
development under consideration (eg a house, block of flats, factory, office, care
home or sports facility) being harmed in the course of a year from the major
hazard site.
Societal risk
6 Societal risk is a measure of the likelihood of a large-scale incident involving
mass casualties, which depends upon integrating the risk of a major incident
occurring with the number of people living or working in the vicinity of the site
who could be exposed and suffer death or major injuries. The derivation of the 60
societal risk estimates requires, in addition to data on the integrity of the plant for
deriving individual risk, an up to date knowledge of the size and distribution of the
working and residential population around the site under review. Quantitative risk
assessment is required to derive estimates of societal risk.
7 Societal risk is expressed as the relationship between frequency and the number
of people sustaining a specified level of harm in a given population due to the
realisation of specified hazards.
8 Societal concern is an expression of the public aversion to large-scale incidents.
For example a rail accident with multiple fatalities will command huge public
attention and calls for preventive action whereas most fatal car accidents attract
little notice even though they are responsible for more deaths each year than rail
travel. The Flixborough and the Piper Alpha disasters (between them resulting in
195 deaths) resulted in global interest both incidents resulted in a loss of public
confidence in the regulatory system and in the industrial sectors.
9 Societal risk can be subdivided in a number of ways. For example:
M national societal risk: the risk to the nation as a whole due to a particular type
of activity, eg nuclear power generation or production of dangerous pathogens;
M local societal risk: the risk to a localised population from a particular type of
activity, eg the risk of harm to the population of Canvey Island from the
various petrochemical installations in the area; and
M case societal risk: the risk at a particular location or from a particular activity,
eg people using a retail development in the vicinity of a hazardous installation.
10 In the context of land use planning at a major hazard site, societal risk is the
likelihood of a disaster involving the off-site population in the vicinity of the site.
For example an investigation was carried out into a proposal for additional
petrochemical installations in the Canvey/Thurrock area (see Figures 1 and 6 in the
main report) where there were existing sites of major accident potential. Each
additional installation would have generated a case societal risk but the
overriding concern was with the cumulative risk to the local population from all
the installations, existing and proposed, in that area, ie the extent of the local
societal risk.
11 The concept of societal risk is more difficult to express in terms of numbers
than individual risk. There will be a range of events that can be postulated. These
will be of different magnitudes, with different probabilities of occurrence, and
different degrees of harm arising from them. Generally speaking in the UK, the
more severe the event the less its likelihood but the greater its potential
consequences in terms of human harm and environmental impact. Therefore
societal risk is often expressed as a line on a graph which plots the relationship
between the likelihood of an event and its estimated consequences in terms of the
number of fatalities. Such lines, or curves, are called FN curves. The shape of this
curve depends on how the population is distributed around the site, and is
therefore very site specific. Obviously, the distribution of the population around a
site changes as new developments take place, whereas the individual risk will not
change if hazardous operations and their control measures on the site do not
change. Therefore the societal risk around a site can change when the individual
risk does not.
12 Measures of societal risk have been developed based on integrating the area
under the FN curve. However, this simple risk integral does not allow for
distinguishing between one accident causing 100 fatalities and 100 accidents each 61
causing one fatality over the same time period. Therefore weighted risk integrals
have been developed to account for societys aversion to multiple fatality events.
FN criterion lines have also been drawn as standards for comparison. The
calculated risk integral for a specific situation is then capable of comparison
against the same integral calculated for a criterion FN curve.
QRA applications of relevance to land use planning around major
hazard sites
13 The full scope quantified risk assessment (QRA) and the production and
interpretation of FN curves
25
is the accepted best means for studying societal risk,
but it is relatively costly, time-consuming and requires a high level of technical
capability. Screening can be undertaken to determine at which sites the full scope
technique is required because of increased concerns for societal risk, or where a
more approximate (and therefore quicker and cheaper) means may be appropriate.
14 The fundamental principle of management of health and safety at work is the
ALARP
26
principle. To demonstrate risks are ALARP site operators have to
undertake a risk assessment, the depth of analysis of which should be
proportionate to the major hazard risks taking account of the nature of the site
operations and the size of the exposed off-site population. Where the risks relate to
major hazards and the potential for killing or harming a number of people or
creating a major accident to the environment, some form of QRA will be required.
Even where the protection concept is currently used at flammable storage sites,
QRA is deployed to determine the most significant individual risks arising from a
site against which to assign consultation distances for land use planning purposes.
15 To integrate societal risk into land use planning around major hazard facilities,
site-specific QRA will be needed. The key principles that illustrate the requirement
for QRA are as follows:
Setting priorities and comparing risk values when adopting best practice or state-
of-the-art technology at COMAH sites
See A guide to the Control of Major Hazards Regulations 1999 (as amended).
Guidance on Regulations
(ref 15)
16 This is of particular relevance at fuel storage sites following the Buncefield
incident to ensure the highest integrity of containment measures to prevent the
escape of fuel from storage tanks. A single model QRA would be applicable to a
range of similar sites. Given the relatively uncomplicated nature of such sites
compared to say a large refinery or a nuclear energy installation, the suitable
methodology would be relatively straightforward.
Estimating the percentage contribution to individual and societal risk of single
large buildings and proposed developments around the site, showing how the
method is capable of measuring the impact on societal risk of incremental
development
See Annex 10 to this report
62
25
FN curves: see paragraph 113 and its footnote in the main report, and Annex 10 in
general.
26
ALARP = as low as reasonably practicable. Risks are deemed ALARP where there is
gross disproportion between the costs to the dutyholder of doing more, against the
benefit gained (in terms of risk reduction) in doing it.
17 Prior to the Buncefield incident, the design event chosen for deriving the
consultation distances using the protection-based system was a tank failure and
pool fire, but post-Buncefield the unintentional release of fuel and the formation of
a vapour cloud that can flow off site may lead to either a flash fire or a large
explosion and both scenarios need to be included in risk assessment. What the
QRA incorporating the three hazard types (pool fire, flash fire and vapour cloud
explosion) would look like is shown in the example we commissioned in Annex 10.
Individual risks of fatality at specific locations can be calculated along with the
percentage of the individual risk due to tank events, as compared to overfill events
and failure of feed pipelines.
Setting the interim consultation distance based on best practice in design and
operations of an installation until the causes of the explosion at Buncefield are
better understood
See Recommendations on the design and operation of fuel storage sites
(ref 4)
and
HSE press release HSE publishes land use planning consultation outcome EO46.07
4 December 2007
18 HSEs interim solution to land use planning around fuel storage depots was to
extend the consultation distances to the area of damage observed in the Buncefield
explosion, with the proviso that it should remain in force until research provides
more information on the mechanism of the vapour cloud explosion which took
place at Buncefield. A precautionary approach can be justified when the level of
uncertainty is high, but can be very restrictive on future economic development
around sites, particularly, for example, where the means of preventing the initiating
event (such as a petrol tank overfill) can be improved.
Providing a structured, objective and quantified approach to meeting ALARP can
contribute to understanding the hazards and the measures needed to control them
See A guide to the Control of Major Hazards Regulations 1999 (as amended).
Guidance on Regulations and The Public Inquiry into the Piper Alpha
Disaster
(ref 10)
19 Good practice applies defence in depth by adopting accepted engineering
principles, along with good operating and maintenance practices. Meeting these
measures or going beyond them in seeking to further reduce individual and societal
risk under the ALARP criterion can be demonstrated using QRA.
63
Annex 6
Development of risk criteria for use in land use planning
1 As early as 1967 Her Majestys Factory Inspectorate (HMFI), one of the
forerunner regulators to HSE, first drew attention to the disaster potential of major
chemical installations. In time this led to the then Department of Environment
issuing a circular (DOE 1/72) requiring planning authorities to consult HMFI on
proposals to develop land in the vicinity of major hazard installations.
Flixborough
2 In 1974 a large amount of vapour escaped from one of the plants at the
Flixborough chemical works, leading to a large unconfined vapour cloud explosion
which killed 28 workers and caused considerable devastation on site. It also raised
concerns about off-site consequences, though no members of the public were
killed.
3 In response, the newly established Health and Safety Commission (HSC) set up
the Advisory Committee on Major Hazards (ACMH). Its remit was to make
recommendations for improving the understanding of accidents arising from major
hazard sites, preventing such accidents occurring and mitigating their consequences
where they did happen. In its three reports in 1976, 1979 and 1982,
(refs 1921)
ACMH made a number of statements which were seminal in influencing HSEs
approach to land use planning. For example it endorsed the consultation
arrangements provided for under circular DOE 1/72 as being essential for
preventing incompatible land uses. HSE, it said, had both the information and
expertise needed to formulate advice on the safety implications of major hazard
installations.
Canvey Island studies 1978 and 1981 reports
(ref 23)
4 Arising from a public inquiry to consider revoking planning permission, HSE
was asked to carry out a study of the risks to people living in and around Canvey
Island from the existing oil refinery in the area and a proposed additional one. The
reports identified both the individual and societal risks to the public arising from
ten major hazard installations. Following substantial public and Parliamentary
debate, a societal risk value of 500 deaths at a frequency of 1 in 5000 years was
accepted at that time as just tolerable and that the somewhat higher risk prior to
safety improvements was not.
Piper Alpha Inquiry 19881990
(ref 10)
5 The explosion and fire on the Piper Alpha oil production platform in the
North Sea in 1988 caused the deaths of 165 platform workers and two rescuers. It
led to a major inquiry conducted by Lord Cullen. This provided confirmation that
the major events predicted by risk analyses were indeed realistic and that QRA
could be a useful tool in trying to reduce the risks. The inquiry report in 1990
recommended a much more modern system of safety regulation for the offshore
industry and this led to new regulations which explicitly required the use of QRA.
64
Study of major hazard aspects of transport of dangerous substances
and ports 1991
(ref 24)
6 This study by HSCs Advisory Committee on Dangerous Substances (ACDS),
which took five years, examined those substances and transport aspects, including
ports, most likely to give rise to significant risks. Societal risk criteria were used as
one test of the tolerability of risk at some of the fixed sites (ports, parking areas,
marshalling yards). The study endorsed the above Canvey post-improvement
criteria, developed an approach for their use in decision making, and reported that
not only did this reflect UK and worldwide experience of events involving major
installations, but also societys decreasing willingness to tolerate increasing
numbers of fatalities. However, it was noted that a community which derived
significant economic benefit from the hazardous activity may well be more
tolerant.
HSE publication Reducing risks, protecting people (R2P2), 1999 and
2001
(ref 13)
7 In response to the Sizewell B inquiry, HSE published in 1988 (with an update
in 1992) reports on the Tolerability of risk from nuclear power stations.
(ref 11)
These not only formulated and published guidelines on the tolerable levels of
individual and societal risk to workers and the public, but outlined how they might
be applied to inform regulatory judgements.
8 Reducing risks, protecting people articulated how statutory bodies responsible
for administration of the Health and Safety at Work etc Act 1974 approached
decisions about the management of risk. Following public consultation, R2P2 set
down the criterion it had adopted for addressing societal concerns where there is a
risk of multiple fatalities occurring from a single event at a major hazard
installation. The criterion was that the risk of an accident causing the death of 50
people or more in a single event should be regarded as intolerable if the frequency
is estimated to be more than 1 in 5000 years. This value was derived for a single
installation using the levels of risk that society was prepared to tolerate at the
multi-site industrial complex at Canvey Island and taking account of technological
improvements since the Canvey study.
65
Annex 7
The Dutch land use planning system
Summary of Dutch approach
1 The Dutch currently get site operating companies to prepare a QRA showing
individual risk (location-specific risk) and societal risk. The inputs, such as failure
frequencies, are set down in a common reference book. Some of these failure
frequencies are reached by agreement between the various authorities.
2 Because of disagreement among experts, the Dutch have recently insisted that
everyone uses the same computational methodology, which includes built-in
methodologies such as dispersion codes. The Det Norske Veritas (DNV) code
SAFETI is used (called SAFETINL).
3 Once contours and FN curves are produced, they are compared against criteria.
For individual risk, strict limits are applied to developments within the 10
-5
and
10
-6
contours. These are mandatory with time limits for implementation established
by a decree operational from 1 November 2004. The decree imposes limit values
for the location-based individual risk for vulnerable objects (red icons) and target
values for less vulnerable objects (orange icons). Vulnerable objects are residential
properties and equivalent premises, such as schools and hospitals, less vulnerable
objects are, for example, small offices and working places, playing fields etc.
Compliance with the limit value of 10
-5
per annum for the location-based risk must
be reached within three years from the decree being operational and compliance
with the limit value of 10
-6
per annum for the location-based risk must be reached
by 1 January 2010 for all vulnerable objects in the vicinity of establishments subject
to the decree.
66
NO vunerable objects
(Houses etc)
NO vunerable objects
(Such as shops, offices etc)
Allowed when SR is
deemed acceptable
*exception:
temporarily allowed
10
-5
10
-6
Figure 18 Risk criteria for
new situations
4 From 2005 any vulnerable objects (red icon: houses, schools etc) will not be
allowed within the 10
-5
zone, then from 2010 none will be allowed within the 10
-6
zone. The limit values are not so strict for less vulnerable objects such as offices.
They are targets but may be temporarily allowed. The orange icon represents these
as targets, but may also be temporarily allowed.
5 For societal risk there is a criterion line, which had a slope of -2 and was a
strict limit reflecting a large aversion to major accidents. The policy was that no
part of the FN curve could cross it, but this caused problems so the limit was
changed to an orientation line. Various parties (local authorities, public, fire
brigades etc) now have to get together to agree development plans. The limit is
there to inform any discussion; if it is exceeded then the reasons have to be
recorded and justified.
6 To help the various parties understand the implications of any change in
societal risk, new methodologies have been developed which show the changes to
societal risk on a colour coded map.
7 The concept of societal risk and associated criteria were found to be difficult to
understand for many people and difficult to implement by the authorities. This was
because societal risk is not a single figure that can be displayed as a contour on a
map. At the request of the Dutch Government, consultants have developed a
concept for an area-specific approach to societal risk. This approach considers the
risks not from the perspective of the source causing the risk, but from those who
are at risk. This area-specific approach shows societal risk displayed by coloured
areas on maps. Orange indicates an area where societal risk is already high so
development is limited, green means there is some room for more urban
development and so on.
8 For further information, see Area Specific Societal risk, societal risk on the
map,
(ref 25)
a paper by TNO (the Netherlands Organisation for Applied Scientific
Research), which gives an account of the traffic light approach with examples of
colour-coded maps.
67
1. 0E -4
1. 0E -5
1. 0E -6
1. 0E -7
1. 0E -8
1. 0E -9
1. 0E -10
Number of casualties
R
i
s
k
/
y
e
a
r
1 10 100 1000
Orientational value
Societal risk curve
Figure 19 Societal risk plot
(FN curve format) for
determining maximum
allowable population at risk
from a major hazard incident
on the site (see paragraph 113
in the main report and
Annex 10 for further
information on FN curves)
Annex 8
Harm criteria used in risk assessment
1 One of the key elements in conducting a risk assessment is setting the criterion
for the harm that an event can cause. The seriousness of different potential events
that can arise from major hazards can only be compared if there is a consistent
criterion for the harm level, which is applicable across different types of hazard,
especially toxics and flammables. This annex explains the two main harm
criteria used.
Risk of fatality
2 This criterion relates to the probability of an individual receiving fatal injury. It
is widely used and allows relatively consistent comparison of risks within and
between sites, nationally and internationally. It does not accommodate serious
injury, nonetheless many everyday risks are expressed in these terms. For instance,
the road safety reports, and accident prevention initiatives, are based on annual
fatality statistics. However, this criterion still needs to be used with care since there
are different definitions, depending on whether the level of hazardous material
presents, for example, a 1% or 50% risk of fatality.
Dangerous dose
2 HSE uses dangerous dose as its main harm criterion. This dose is defined as the
level of toxic gas, or heat, or explosion over-pressure which gives all the following
effects:
27
M severe distress to almost everyone;
M a substantial fraction requiring medical attention;
M some people seriously injured, requiring prolonged treatment; and
M death in highly susceptible individuals.
3 The risk assessed in this way is the probability over the following year of an
individual at a particular location being exposed to a dangerous dose or worse,
depending upon the distance from source of the exposure.
4 Originally HSE advised on the basis of a concept of protection of those
exposed to a hazard so that the separation distance between development and
hazard provided a high degree of protection against the more likely smaller events,
while giving worthwhile protection against unlikely but foreseeable larger scale
events. To apply the concept in practice required the identification of the worst
events (of fire, explosion or toxic release) and then determination of a separation
distance based on exposure to a defined level of harm, namely the dangerous dose.
68
27
Note that damage to buildings is not taken into account except where such damage may
cause harm to people. This approach does not account for damage to the environment.
5 Later HSE changed to advising LPAs on the basis of risk for some types of
hazard. In these cases the risk was the probability per year of an individual at a
particular location being exposed to a dangerous dose or worse. Based upon
information supplied by the LPA, HSE produces a three-zone map, the outer
boundaries of which represent either defined levels of risk or specified
consequences from the identified event. This is further illustrated in Annex 4.
6 The choice of the dangerous dose criterion is to accommodate risks of serious
injury as well as death and because there are technical difficulties in calculating
risks of death from a hazard to which individual members of a population may
have widely differing vulnerabilities. However, contained within the concept of
dangerous dose or worse is a range of outcomes with some types of event being
more biased towards causing fatalities. Thus two different events assessed as
having similar consequences in terms of dangerous dose may in fact cause very
different results in terms of the number of fatalities. In practice, the use of
dangerous dose makes it difficult to compare risks within sites between different
types of hazard (toxics and flammables), and between sites.
7 The following is an extract from risk criteria document 1989,
(ref 9)
explaining
the provenance of the concept of dangerous does or worse at that time. This
extract puts into context the value of adopting dangerous dose or worse, although
many of the considerations favouring this approach have been overcome.
Dangerous dose or worse
48 It has often been assumed that risk criteria for major hazards should relate
to the likelihood of death. This seems straightforward and easy to compare
with risks from other hazards in life. However there are two important
problems with a criterion based on the risk of death in the present context:
(a) society is concerned about risks of serious injury or other damage as well
as death;
(b) there are technical difficulties in calculating the risks of death from a
hazard to which individual members of a population may have widely
differing vulnerabilities.
49 The second point may be appreciated by considering an example, such as
the toxic gas chlorine. If a cross-section of the population were exposed to a
dangerous cloud of chlorine, some people would be more seriously affected
than others, and a proportion might die. Those who died could have had some
pre-existing condition or weakness which made them more vulnerable, but
there might also have been people who had simply been exposed to high-
concentration pockets of gas in the cloud. It is not possible to identify in
advance who these people would be, nor is it possible to predict a particular
persons susceptibility to chlorine. Thus it is not possible to say with certainty
what is the probability of a particular person being killed by a particular
exposure to chlorine. This implies that it is not possible to calculate an
individual risk of death for a particular person. However, there are techniques
(eg probit transformations) which permit the calculation of proportions of
populations affected by a given level of harm; these are also subject to
uncertainties.
50 It is of course possible to take average or typical susceptibility and
average concentration, and to use these to produce average individual risks.
This average might conceal a very wide range of risks to particular people,
and it is not clear whether it has any real meaning.
69
51 One approach to this sort of problem is to consider the case of the
particular individual who is most at risk. This would give an indication of the
maximum likely level of individual risk in situations where there is a variation
about the average. The approach is questionable for the present purpose as
there may be no obvious limit to susceptibility; people with severe breathing
problems may be extremely sensitive. Thus it is not possible to draw the line
and define the worst case individual.
52 It is possible to avoid some of these problems by using an injury criterion
other than death. For example, it is possible to define a dose of toxic gas, or
heat, or explosion overpressure which gives all the following effects: severe
distress to almost everyone; a substantial fraction requires medical attention;
some people are seriously injured, requiring prolonged treatment; any highly
susceptible people might be killed. This might be described as a dangerous
dose, as it has the potential to cause death but it will not necessarily do so.
Then the risk assessed is that an individual at a particular place will be exposed
to such a dangerous dose or worse. The results of such an assessment may be
described as:
The risk that a typical user of the development will be exposed to a dangerous
dose or worse of toxic gas, heat or explosion overpressure.
70
Annex 9
HSEs fundamental review of its role in land use planning
1 In 1998 HSE initiated a fundamental review which scrutinised its role in, and
approach to land use planning. The review was wide ranging and covered issues
such as:
M the criteria and methodology used for setting planning zones and for calling
in planning applications;
M codification so that HSE can provide transparent and accurate advice without
detailed individual assessment of planning applications;
M devolving the codified advice so that local planning authorities (LPAs) can deal
with the vast majority of planning applications themselves and developing a
communication strategy to ensure buy-in to this devolution;
M reconsidering what to assess under the Consents legislation; and
M positioning HSE to influence any European developments.
2 The fundamental review reported back with a range of recommendations in
2001, and was followed up in 2002 by initiation of an implementation project.
The Project Initiation Document identifies the following recommendations as
within scope:
M the criteria and methodology used for setting planning zones and for calling
in planning applications should be reviewed and, if necessary, revised and then
published;
M HSEs advice to LPAs on chemical major hazards and pipelines should be
further codified so that transparent and accurate advice can be given without
detailed individual assessment of planning applications;
M the codified generic advice should be devolved to LPAs so that they can deal
with the vast majority of planning applications which are in the vicinity of
chemical major hazards and pipelines.
3 Additionally, it was considered that the project:
M should consider the respective roles of COMAH and legislation relating to land
use planning in ensuring that risks (both societal and individual) to members of
the public are appropriately controlled and if necessary, develop policy and
guidance;
M should reopen the debate on what to assess under the Consents legislation;
M should contribute to the work of European Commission Technical Group 5,
re-established following the Toulouse ammonium nitrate explosion, so that
HSE can be in a position to influence any European developments;
M should develop and implement a communication and engagement strategy to
ensure optimum buy in by LPAs and other key stakeholders to the devolution
proposals.
71
4 One product of this is devolution of a decision-making tool to LPAs Planning
Advice for Developments near Hazardous Installations (PADHI), which uses
individual risk as the criterion. During 2006 and 2007, HSE gave all planning
authorities in England, Scotland and Wales online access to PADHI+, which
comprises a consultation zone library for all hazardous installations and pipelines
together with a PADHI+ advice generator. The computer code in PADHI+
generates a decision to not advise against (DAA) or advise against (AA) based on
HSEs experience of giving advice to LPAs. The decision matrix based on the
sensitivity level of the development is shown in paragraph 12 of Annex 4.
5 Another consequence of the implementation project was for HSE to
commission two independent reviews, both of which reported in 2004. These were:
M review of HSEs risk analysis and protection-based analysis approaches for
land use planning; and
M HSE land use planning models and methodologies review.
6 However, during the implementation of PADHI+, HSE began work with a
cross-government task force exploring future policy on societal risk. The feasibility
of delivering all the recommendations of the fundamental review was reconsidered
in terms of interaction with societal risk policy. As a result a number of the
recommendations of the fundamental review have yet to be implemented.
See www.hse.gov.uk/landuseplanning for more information.
72
Annex 10
Summary of work commissioned of DNV by MIIB to develop an
illustrative risk based approach to land use planning around flammable
storage sites
Introduction from the Buncefield Board (MIIB)
1 Det Norske Veritas (DNV) was commissioned to provide an independent illustration of
what a risk-based model for land use planning at flammable storage sites might look like.
We present a summarised version of their report below.
2 The work carried out by DNV shows how risks from a large petroleum facility can be
estimated in the form of individual and societal risk and illustrates the advantages of
adopting QRA in a new land use planning system in Britain. It demonstrates clear
advantages in land use planning over the protection concept in use at the time of the
Buncefield incident, but the events included here of vapour cloud formation, flash fire and
explosion were not recognised hazards before the incident.
3 The assumptions and methodologies used in this report were the decision of DNV and
have not been approved by the Buncefield Board or its advisors, nor subjected to external
peer review. The frequency data used in computing the frequency curves in Figures 2024
are based on internationally available data. The relevant sources of data for those figures
are Lastfire, and Purple Book, and references are provided as footnotes to the text.
Summary report
Background to the report
4 At the time of the Buncefield incident neither the regulator nor the industry considered
a large flammable cloud explosion to be a reasonably foreseeable event that needed to be
taken into account in the design and operation of flammable storage sites, and in the
emergency preparations and response planning at such sites. Since Buncefield the reliance
on a protection-based approach to land use planning around flammable storage sites has
been questioned. The Buncefield Major Incident Investigation Board (MIIB) that was
appointed by Government to oversee the incident investigation has responded to two
consultation documents issued by the Health and Safety Executive on land use planning
(CD211) and on societal risk (CD212).
5 In its response to CD211 MIIB indicated that (a) advice on land use planning should
be based more on a consideration of risk, (b) more attention should be paid to the
population at risk and (c) it considered that land use planning should be responsive to the
levels of risk presented by each particular site. In its response to CD212 it gave a view that
land use planning and societal risk are inextricably linked. The MIIB commissioned Det
Norske Veritas (DNV) to carry out an independent preliminary risk analysis using the
Buncefield site as it was prior to the explosion to illustrate the QRA method and its uses
by incorporating the now-recognised full range of hazards fuel storage sites may present.
Scope of and approach to the report
6 The scope of work defined by MIIB was as follows:
M provide an independent view on what a risk-based approach to land use planning in
the vicinity of large petroleum storage facilities might involve and show how this might 73
be achieved in practical terms. This would include consideration of risk-based
options in place elsewhere, particularly in Europe, including their perceived
limitations. It would take into account HSE published material, and previous
reports of MIIB and the hierarchy of control of major hazard risks;
M establish the nature of data that need to be determined or assigned in order to
produce a risk-based model, and their source;
M show whether such a model can incorporate inherent risk reduction measures as
called for in MIIB reports;
M show to what extent such a model could be used to determine societal risk and
therefore provide an input into any decision making process.
7 DNVs approach to this work was as follows:
M develop a methodology that could be applied to a site similar to the Buncefield
site that would enable a quantified risk analysis (QRA) to be carried out which
would give predictions for both individual and societal risk, identifying the major
uncertainties in the analysis;
M apply the methodology used for risk assessment/development control in the
Netherlands to the same site;
M review the predictions and consider whether a methodology based on risk rather
than a mixture of risk and hazard could be used in the UK for future land use
policy around major hazard site.
Methodology and assumptions
8 The methodology used followed the classical approach to process QRA.
Generally DNV considered the assumptions made to be reasonable, neither overly
conservative nor optimistic so that the analysis gives a realistic estimate of the risk,
although it is recognised that the error band will be quite wide, and this would need
to be taken into consideration should the predictions be used for decision making.
The system that was analysed comprised the west part of the Buncefield site,
including the tanks in the vicinity of Tank 912 which was the source of leakage, the
bunds, the feed pipelines and the export pipelines.
9 The hazard types analysed were:
M pool fires;
M flash fires;
M vapour cloud explosions.
10 Extrapolation from conventional dispersion codes was used to determine cloud
sizes in low wind speed conditions to replicate the vapour/aerosol cloud that was
produced at Buncefield (as the task was beyond the scope of CFD
28
was beyond the
scope). Pool fires were modelled using a solid flame technique. Vapour cloud
74
28
Computational fluid dynamics (CFD) is a method that enables the study of the dynamics of
things that flow. CFD is the numerical approximation to the solution of mathematical models
of fluid flow and heat transfer. Computational fluid dynamics is one of the tools (in addition
to experimental and theoretical methods) available to solve fluid-dynamic problems.
explosion modelling was based on the observed effects of the Buncefield explosion
(RR511),
(ref 26)
by deriving decay curves from an assumed cylindrical cloud. A
number of decay curves were used to represent the range of effects seen at Buncefield
and larger and smaller clouds than ignited at Buncefield. The curves were derived for
use in the Multi Energy framework, assuming a maximum overpressure of 350 mbar.
Flash fires were represented by the same cloud that was used for the explosion
predictions. The effect of the hazards on people in different building types was based
on available vulnerabilities.
11 Frequency analysis used generic data from both HSE and Purple Book
(ref 27)
sources. The overfill frequencies were derived from data provided either by MIIB
(termed MOC data) or by the Lastfire Group
29
(again via MIIB). Ignition
probabilities were assigned based on an assumption that delayed ignition increases
with cloud size and cloud duration. Explosion probabilities were also assigned and
assumed increasing probability with cloud size.
12 A number of different analyses were carried out with the following assumptions:
M the overfill frequency was as per the MOC data, with tank failure data as per
HSE;
M the overfill frequency was as per the Lastfire Group data, with tank failure data
as per HSE;
M the overfill frequency was as per the Lastfire Group data, with tank failure data
as per the Purple Book;
M the overfill frequency was as per the Lastfire Group data, with tank failure data
as per the Purple Book with mitigation measures to ensure that the release
duration did not exceed 600 seconds.
13 In the DNV analysis Northgate was the main contributor to societal risk in the
area. A small sensitivity analysis was carried out to examine the effects on the overall
or area societal risk
30
at Buncefield of moving the Northgate building 100 m and
200 m further away from the installation.
14 The predictions were given in terms of:
M hazard frequency and individual risk contour plots;
M individual risk at specified locations;
M societal risk.
15 The method of analysis used in the Netherlands for land use planning was also
applied to the same site.
75
29
Lastfire (Large Atmospheric Storage Tank Fires) is a consortium of international oil
companies engaging in projects reviewing the risks associated with fires in storage tanks
and developing suitable industry practise to mitigate the risks
www.resprotint.co.uk/lastfire.htm.
30
Otherwise known as local societal risk see Annex 5 for an explanations of national,
local, and case area risk.
Results
16 The preliminary analyses using methods adopted for this project show where
most of the potential risk lies and where control measures need to be focused:
M only the overfill events, the failure of the feed pipelines and the tank failures
gave cloud formation rates that were sufficient to give a vapour cloud above the
assumed threshold explosion volume (ie the other scenarios gave only flash fires
and pool fires);
M the contribution to the offsite risk from explosions following the failure of the
feed pipelines was insignificant compared with the overfill and tank events;
M the pool fires do not give levels that are considered to give fatal injuries at any
of the buildings.
17 The explosions included in the analysis have the potential to cause significant
knock on or domino effects (failure of adjacent tanks and subsequent ignition of
released liquids, as occurred during the incident). The effects of these secondary
events were not included in the risks presented.
18 Examples of the outputs are shown below. The blue line marked CD on the
plots is the consultation distance assigned by HSE for the Buncefield site following
the implementation of Option 4 (CD211). The other contours show plots of the
frequency of the overpressure generated should an explosion occur. The contours
join up those points where the frequencies are the same.
19 Figure 20 shows the plots of where the frequency of an over-pressure exceeds
the dangerous dose (in this case 70 mbars). The dangerous dose here represents that
dose which would cause a few per cent deaths in a vulnerable population. Figure 21
shows similar plots, but where the frequency of an overpressure exceeds 140 mbar.
This is the dangerous dose HSE uses for a normal population.
20 The frequencies are 1 chance in 10 million per year (1 x 10
-7
/year) for the outer
contours (dark blue), 1 chance in a million per year (1 x 10
-6
/year) for the next one
further in (green), 1 in 100 000 (pale blue), 1 in 10 000 (orange) and 1 chance in
1000 per year (red).
76
Figure 20 Frequency of over-
pressure exceeding 70 mbar
(HSE dangerous dose for
vulnerable population)
- 1 x 10
-7
per year
- 1 x 10
-6
per year
- 1 x 10
-5
per year
- 1 x 10
-4
per year
- 1 x 10
-3
per year
Risk of static over-pressure
exceeding 70 mbar
21 These frequency plots could be used to delineate zones for land use planning
purposes using the 1 in 100 000, 1 in a million and 1 in 10 million risk of
dangerous dose or worse contours for a normal population. It can be seen that
using the assumptions used in the calculations in this report this would lead to a
smaller consultation distance. It might therefore be possible to utilise some of these
frequency plots for land use planning purposes bearing in mind that these contours
are for explosions only, but it would be advantageous and less confusing to use
risk of death from all events rather than just the risk of over-pressure.
22 The contours in Figure 22 show risk of fatality gives rise to a 1 chance in
10 million per year of death that is comparable with the existing consultation
distance. These are location specific risk contours. They are for people in typical
brick buildings occupied for 365 days per year being affected by the process
hazards on the site. They show the risks to people in the vicinity of the installation
from the various hazardous events that might occur from loss of containment of
the petrol. It is easier to compare the risks in these terms with other risks such as
77
Figure 21 Frequency of
over-pressure exceeding 140
mbar (HSE dangerous dose
for a normal population)
- 1 x 10
-7
per year
- 1 x 10
-6
per year
- 1 x 10
-5
per year
- 1 x 10
-4
per year
- 1 x 10
-3
per year
Risk of static over-pressure
exceeding 140 mbar
Figure 22 Individual risk of
fatality
- 1 x 10
-7
per year
- 1 x 10
-6
per year
- 1 x 10
-5
per year
- 1 x 10
-4
per year
- 1 x 10
-3
per year
Risk of individual fatality
being struck by lightning since most other risks are similarly expressed as risks of
death. They are also more readily comparable (with care) with HSE risk criteria as set
down in R2P2.
(ref 13)
For example the tolerable risk to a member of the public from a
work activity should be no worse than 1 in 10 000 per year (1 x 10
-4
) represented by
the orange contour.
23 In Figure 23 it can be seen that the risk contours generated using the Netherlands
methodology are even smaller than those above and are well within the existing HSE
defined consultation distance.
Societal risk (FN format)
24 FN curves are obtained by plotting the frequencies at which multiple fatality
events might kill N or more people. The technique provides a useful means of
comparing the impact profiles of man made accidents.
25 In Figure 24 the red line indicates the frequency of killing N or more people
arising from overfilling events; the green line from tank failures, and the black line the
societal risk from both events, adding the risks together. The plot is relatively flat
showing a relative small change in frequency of event until you get to the really large
accidents involving over 200 people. After this the frequency reduces rapidly until the
limit of possible people killed is reached. The FN plot usefully shows that the overall
societal risk can be broken down to show the various contributors to the overall FN
risk curve. This can be used to target where you put your risk reduction measures.
Conclusions from the study
26 The QRA demonstrated that the risks associated with a large petroleum storage
facility can be determined, despite the uncertainties and different assumptions
representing different site conditions or different levels of safety give different risk
predictions. The analyses show the effects of changing assumptions regarding:
M the frequency of overfilling a tank (which might be achieved by a more reliable
overfill protection system);
78
Figure 23 Individual risk
of fatality (Netherlands
methodology)
- 1 x 10
-9
per year
- 1 x 10
-8
per year
- 1 x 10
-7
per year
- 1 x 10
-6
per year
- 1 x 10
-5
per year
- 1 x 10
-4
per year
- 1 x 10
-3
per year
- 1 x 10
-2
per year
Risk of individual fatality
- Netherlands methodology
M the reduction in the duration of the overfill (which might be achieved by gas
detection and remotely or automatically operated valves); and
M the mitigation due to different building design as well as the effect of different
base frequency data.
27 Other QRAs of this type of facility would likely follow the same approach,
but, there is considerable scope for differences in the details in different QRAs,
particularly the assumptions for frequencies and the analysis of consequences, and
hence there would be differences in the numerical risk values predicted. Some of
the more significant uncertainties in the analysis were:
28 The different properties of gasoline, including seasonal variations:
M the rate of formation of a vapour/aerosol cloud given a release of gasoline from
piping or tank at different heights and with different potential mechanisms for
the formation of both vapour and liquid droplets which remain airborne;
M the dispersion of the vapour/droplet cloud, particularly in low wind speed
conditions;
M the size of the steady state cloud in different weather conditions;
M the magnitude of overpressure given ignition of the cloud both within and
outside the cloud;
M the frequency of releases from piping and tanks;
M the probability and timing of ignition;
M the probability of an explosion given ignition for different weather conditions
and sizes of cloud.
79
1 x 10
-3
1 x 10
-4
1 x 10
-5
1 x 10
-6
1 x 10
-7
1 x 10
-8
1 x 10
-9
Frequency of N or more fatalities (per year)
Lastfire Overfill Data Purple Book Tank Data F-N
Number of fatalities (N)
1 10 100 1000
LFPB Overfill
LFPB SR
LFPB Tanks
Figure 24 Societal risk
arising from major hazards
on the model site
29 With further investigation the values used for some of the assumptions could
become more robust (eg overfill frequency, tank failure frequency), but some will
require considerably more time and analysis (eg likelihood of over-pressure
generation) and for consequence information possibly even experiments (eg
gasoline dispersion in low wind speed conditions, magnitude of an explosion and
what conditions would/would not cause over-pressure). Work on the explosion
mechanism that occurred at Buncefield has started, but detailed information for
design purposes may take some time to produce. Data could be improved by the
introduction of a formal system for collection, reporting and sharing of data across
the onshore process sector. Such a system has been recommended by MIIB.
31
The
system could be similar to the data sharing system developed for the offshore
sector after the Piper Alpha accident. The COMAH Competent Authority could,
either by regulation or agreement with the sector,
32
introduce a similar system for
the onshore process sector, and if this was as successful as the offshore system,
would produce a good quality database within a few years. If data already in the
possession of companies (as provided to the Lastfire Group) were to be made
available, this would put the frequency values on a far sounder footing and thereby
improve the robustness of process QRAs.
30 The QRA estimates both the individual risk and societal risk of fatality that are
needed for decision making. This type of analysis is currently used as a basis for
onsite decisions (but with the inclusion of more scenarios) and its use could be
extended to off-site land use planning decisions. Its use for such purposes would
require some changes to be made to the current UK system. Possible changes are
discussed below.
31 The current system of land use planning used in the UK derives essentially
from a consultative document issued in 1989.
(ref 9)
HSE uses a combination of
hazard (the protection concept) and the risk of a dangerous dose or more
33
to
define land use planning zones. In short the protection concept quantifies the
consequences for a single scenario and determines the distance to a dangerous dose
from that single scenario, whereas the risk-based approach quantifies both the
consequences and the frequencies of a number of different scenarios and cumulates
them. The use of dangerous dose is different from most QRAs (which use fatality),
is different from the risk measure used in most other European countries for land
use planning purposes, is different from the values assigned by HSE to the
tolerability of risk framework and is different from data used to compare risk
predictions with everyday risks. There would therefore be many advantages if the
HSE changed to a land use planning system based on the risk of fatality.
32 Land use planning zone boundaries determined over the last few years would
normally be based on the information in the hazardous substances consent
(HS Consent). Although this information is specific in terms of the size of the
largest vessel, it may not be specific in terms of the material (because of generic
material classes). Consequently HSE bases its assessment on what could be stored
80
31
See Recommendations 23, 24 and 25 in Recommendations on the design and operation
of fuel storage sites.
(ref 4)
32
Offshore hydrocarbon release reporting is voluntary, but universally supported by
industry.
33
A dangerous dose of a toxic gas will give a range of effects because of different
susceptibilities of different people, but will give all of the following severe distress to
almost everyone, with a substantial fraction requiring medical attention, serious injury
with a requirement for prolonged treatment for some people and highly susceptible
people might be killed.
under the terms of the HS Consent rather than what is actually stored on the site, so
the risk at a zone boundary is based on a hypothetical risk. In determining the
boundary HSE generally uses a material with properties at the most severe end of a
class. There is very limited account taken in these assessments of measures that are
in place at the site to mitigate the risks. The zone boundaries are therefore larger
than if they took into account the actual material and the control and mitigation
measures. Further, the current system does not lend itself to the cumulation of risks
from different hazard types nor to the extension to societal risk.
33 The Netherlands and Belgium use both individual and societal risk (of fatality)
as inputs and determinants for land use planning. The two approaches have some
advantages and some disadvantages, such as:
M the methodology is set in the Netherlands so that two sites with the same design
would pose the same individual risk. This may not be the case in Belgium;
M it is understood that the methodology in the Netherlands is fixed for a period of
five years, and after this time changes can be made to update the methodology.
This could impact on the location of the land use planning zones. In Belgium the
methodology is more flexible and so changes to methodology and experience
(such as the Buncefield incident) can take place more quickly. Again, however,
these can impact on existing land use planning zones;
M the use of individual risk of fatality allows the effects of different types of
hazards to be combined and also extended in a consistent way to societal risk.
34 As in the UK, the methodology for the analysis and the use of the risk
predictions for land use planning are determined by the regulator. The actual
analysis, however, is carried out by the operator of the site. A similar system if
applied to the UK as control would still rest with the regulator, but the time and cost
to carry out the analysis would fall on the occupier, and given that most occupiers of
major hazard sites have carried out some QRA, the additional cost would be
relatively small. Although QRAs were expensive when the methodology was being
developed (some 30 years ago) since then there have been significant advances in the
computer programs which aid the analysis, so that the cost of QRAs is now much
less. Much of the cost of a QRA is associated with the time for the definition of
input data and assumptions rather than the analysis itself and most sites will already
have these input data.
35 As far as the cost of doing QRA is concerned, HSE has already invested
considerable resources into the development of state of the art consequence models
over the last 25 years and in 2004 there were approximately 80 models and over
20 methodologies in the HSE land use planning portfolio. HSE also has much data
on most of the frequencies required for an analysis. Major companies have also
developed QRA methods, using either commercially available or in-house developed
consequence models, and either generic or company specific frequency data and use
these for decision making. The development of a standard methodology,
incorporating the experience that HSE has acquired in the determination of risk at
major hazard installations, should therefore be reasonably straightforward. The
methodology would, however, need to include sufficient detail so that all the
information required by a planning authority to decide on the appropriateness of a
new hazardous installation or development in the vicinity of an existing installation
was made available. This would mean that the risk predictions would be based on
the actual operations at an installation (eg as detailed in the COMAH safety report
for top-tier sites) including the prevention measures, the extent and reliability of the
control measures, and mitigation, eg through building design, and take account of
emergency response. It would be expressed not only in terms of individual risk but
also in terms of societal risk of fatality. 81
36 The issue of CD212 and feedback from the consultation indicated the level of
interest in societal risk and the difference in both knowledge and expectations of
stakeholders compared with that prevalent at the time the land use planning risk
criteria document
(ref 9)
was issued in 1989. The feedback indicated:
M there was considerable support for using societal risk to aid decisions regarding
both on site control measures and land use planning;
M it was considered important that the assessment of the site operations and the
land use planning process could give acceptable levels of safety to people in the
vicinity.
37 For most QRAs where the individual risk of fatality is determined, the
extension to societal risk requires relatively minor effort. Methodologies typically
in current use are straightforward to implement and transparent. Given the
availability of aerial photographs and the existing knowledge about the external
population (by the number of people who could be affected by the activities at a
site and the distribution of information to those within a specified distance of an
installation), the data required should be readily available and be sufficiently
detailed to be a suitable input for long-term land use planning decisions and
individual applications. The extension from individual risk to societal risk would
therefore have benefits for improving site safety as well as providing more
information for land use planning. Decisions about the safety of people in on-site
buildings do not necessarily need to be based on a QRA, but the extent, severity
and likelihood of harm do need to be considered and this would be, in most cases,
be quantitative (as there is a numerical criterion for new buildings, an ALARP
demonstration is required for existing buildings and HSE guidance contains a
quantified methodology). Hence the use of risk for decisions for off-site
development will bring land use planning in line with onsite decisions for safety of
people in buildings.
38 The overall societal risk from a single installation can be broken down to show
the main contributors both in terms of the source of risk and the receptor of risk.
The PLL (potential loss of life a single number that represents societal risk) can
indicate the percentage reduction in risk that can be achieved, and, with a cost of
life input, it can be determined whether risk reduction either at source or by
mitigation is likely to be reasonably practicable. Societal risks can also be added,
so the overall societal risk from all the major hazards within a local authority area
could be determined for the LPA who would be able to see the effect on the
societal risk over a period of time due to changes in both the hazardous
installation and the population in the vicinity of the installation (for this to be
effective the analysis would need to be live and societal risk calculations would
need regular updates in line with changes on the major hazard installation and in
the population in the vicinity, probably as part of COMAH updates). This would
enable better long-term spatial planning than is possible on currently available
information.
39 A move in Britain to an approach that was totally based on risk (individual
and societal risk of fatality) would retain some of the advantages inherent to the
current system for land use planning around major hazard sites. It would at the
same time remove many of the undesirable features of the current system discussed
above, enable land use planning around major hazard sites to be more soundly and
consistently based, and would be a close representation of the risks from an
installation. In the development of such a system the main challenges would be
technical with a consensus needed on the appropriate methodology, and in the
management of the changes to some land use planning zones as well as the costs. It
could not be expected that the predicted risk levels at an installation in Britain
82
would correspond with the predicted risk levels at the same facility in a different
EU country (even though they may be the same), which would be the ideal
situation, but a change to a common and defined system based on risk of fatality
would mean that the risk measures are consistent. Further, it would enable a
consistent methodology to be used for both on-site and off-site decisions, and
could be devised to incorporate the best features of the current systems that have
been developed for use in other EU countries (eg the Netherlands and Belgium) or
by major companies and so would be a robust basis for decision making. A move
to an approach based on the risk of fatality would also bring UK land use planning
in line with advice on airports, the advice in R2P2 and remove much of the current
confusion and inconsistencies.
83
References
1 Fourth report: Initial Report to the Health and Safety Commission and the
Environment Agency of the investigation into the explosions and fires at the
Buncefield oil storage and transfer depot, Hemel Hempstead, on 11 December
2005 Buncefield Major Incident Investigation Board 2006
www.buncefieldinvestigation.gov.uk
2 Proposals for revised policies for HSE advice on development control around
large-scale petrol storage sites Consultative Document CD211 HSE 2007
www.hse.gov.uk/consult/2007.htm
3 Proposals for revised policies to address societal risk around onshore non-
nuclear major hazard installations Consultative Document CD212 HSE 2007
www.hse.gov.uk/consult/2007.htm
4 Fifth report: Recommendations on the design and operation of fuel storage
sites Buncefield Major Incident Investigation Board March 2007
www.buncefieldinvestigation.gov.uk
5 Sixth report: Recommendations on the emergency preparedness for, response to
and recovery from incidents Buncefield Major Incident Investigation Board 2006
www.buncefieldinvestigation.gov.uk
6 Council Directive 96/82/EC of 9 December 1996 on the control of major-
accident hazards involving dangerous substances Official Journal L10 1997 1333
(the Seveso II Directive Article 12 applies to land use planning)
7 Risk assessment: Report of a Royal Society study group Royal Society 1983
ISBN 978 0 85403 208 2
8 The economics of land use planning HSE 2008
www.hse.gov.uk/economics/research.htm
9 Risk criteria for land use planning in the vicinity of major industrial hazards
HSE Books 1989 ISBN 978 0 11 885491 7
10 Lord Cullen The Public Inquiry into the Piper Alpha Disaster The Stationery
Office 1990 ISBN 978 0 10 113102 5
11 The tolerability of risk from nuclear power stations HSE 1992
www.hse.gov.uk/nuclear/tolerability.pdf
12 Seventh report: Explosion Mechanism Advisory Group report Buncefield
Major Incident Investigation Board March 2007
www.buncefieldinvestigation.gov.uk
13 Reducing risks, protecting people: HSEs decision-making process R2P2
HSE Books 2001 www.hse.gov.uk/risk/theory/r2p2.htm
14 Key Programme 3: Asset Integrity Programme HSE 2007
www.hse.gov.uk/offshore/kp3.pdf
84
15 A guide to the Control of Major Accident Hazards Regulations 1999 (as
amended). Guidance on Regulations L111 HSE Books 2006
ISBN 978 0 7176 6175 6
16 Reducing error and influencing behaviour HSG48 (Second edition) HSE Books
1999 ISBN 978 0 7176 2452 2
17 Successful health and safety management HSG65 (Second edition) HSE Books
1997 ISBN 978 0 7176 1276 5
18 Containment of Bulk Hazardous Liquids at COMAH Establishments -
Containment policy Supportiong Guidance for Secondary and Tertiary
Containment Environment Agency, HSE, SEPA 2008
www.environmentagency.gov.uk/commondata/release_2041305.pdf
19 Major Hazards: Advisory Committee Report: 1st HSE 1976
ISBN 978 0 11 880884 2
20 Major Hazards: Advisory Committee Report: 2nd HSE 1979
ISBN 978 0 11 883299 1
21 Advisory Committee on Major Hazards: Third report HSE 1984
ISBN 978 0 11 883753 8
22 First report: The Buncefield Investigation: Progress report Buncefield Major
Incident Investigation Board 2006 www.buncefieldinvestigation.gov.uk
23 Canvey A Review of Potential Hazards from Operations in the Canvey
Island/Thurrock Area Three Years After Publication of the Canvey Report:
Summary (HAR) HSE 1981 ISBN 978 0 11 883618 0
24 Major Hazard Aspects of the Transport of Dangerous Substances HSE 1991
ISBN 978 0 11 885699 7
25 Area Specific Societal risk, societal risk on the map 2006-A-R0021/B TNO
2006 www.sharedspaces.nl/pagina.html?id=10221 under Policy
Development/Societal Risk
26 Revised land use planning arrangements around large scale petroleum depots
RR511 HSE Books 2007 www.hse.gov.uk/research/rrhtm/index.htm
27 Guidelines for quantitative risk assessment RIVM December 2005 CPR 18E
(the Purple Book)
85
Glossary
ALARP acronym for the legal term as low as is reasonably practicable. It
requires the weighing up of the level of risk against the costs in the widest sense of
averting that risk. Only where the dutyholder can show that the costs of averting
the risk are grossly disproportionate to the benefits from further reducing the risk
can it be said that the risk has been reduced ALARP.
COMAH the Control of Major Accident Hazards Regulations 1999 Regulations
(COMAH).
COMAH sites sites to which the COMAH Regulations apply.
Competent Authority the COMAH Regulations are enforced by a joint
Competent Authority comprising HSE and the Environment Agency in England
and Wales, and HSE and the Scottish Environment Protection Agency (SEPA) in
Scotland. The Competent Authority operates to a Memorandum of Understanding
which sets out arrangements for joint working.
consultation distance the distance round major hazard sites set by HSE within
which local planning authorities are required to consult HSE on all new planning
applications.
containment barriers which, in the event of a spill, can prevent spilled materials
from reaching the environment.
Control of Major Accident Hazards Regulations 1999 the main aim of these
Regulations is to prevent and mitigate the effects of those major accidents
involving dangerous substances, such as chlorine, liquefied petroleum gas, and
explosives which can cause serious damage/harm to people and/or the
environment. The Regulations treat risks to the environment as seriously as those
to people. They apply where threshold quantities of dangerous substances
identified in the Regulations are kept or used. See also Seveso II.
dangerous dose a dose large enough to lead to: severe distress to all; a substantial
number requiring medical attention; some requiring hospital treatment; and some
(about 1%) fatalities.
dutyholder in the context of this report, any person or organisation holding a
legal duty in particular those placed by the Health and Safety at Work etc Act
1974, the Management of Health and Safety at Work Regulations 1999, and the
COMAH Regulations 1999.
Environment Agency the Environment Agency is the lead regulator in England and
Wales with responsibility for protecting and enhancing the environment. It was set
up by the Environment Act 1995 and is a non-departmental public body, largely
sponsored by the Department for Environment, Food and Rural Affairs and the
National Assembly for Wales.
hazard anything with the potential to cause harm.
Health and Safety Commission the Health and Safety Commission was a statutory
body, established under the Health and Safety at Work etc Act 1974, responsible
for health and safety regulation in Great Britain. It merged with the Health and
Safety Executive on 1 April 2008. The roles and functions of the Commission have
now transferred the new HSE. 86
Health and Safety Executive the Health and Safety Executive was a statutory
body, established under the Health and Safety at Work etc Act 1974, and an
enforcing authority working in support of the HSC. It has now merged with the
Health and Safety Commission, taking over its roles and functions. Local
authorities are also enforcing authorities under the Health and Safety at Work etc
Act 1974.
HSC see Health and Safety Commission.
HSE see Health and Safety Executive.
Northgate a business located alongside the north-western perimeter of Buncefield
whose premises was affected by the Buncefield incident.
on-site and off-site emergency plans operators of top-tier COMAH sites must
prepare adequate emergency plans to deal with the on-site consequences of
possible major accidents and to assist with off-site mitigation. Local authorities for
areas containing top-tier COMAH sites must prepare adequate emergency plans to
deal with the off-site consequences of possible major accidents, based on
information supplied by site operators
over-pressure for a pressure pulse (or blast wave), the pressure developed above
atmospheric pressure is called the over-pressure.
Planning Advice for Developments near Hazardous Installations (PADHI)
software tool developed by HSE which in the vast majority of cases allows local
planning authorities to obtain HSEs advice on an intended development within the
consultation distance of a major hazard site.
pool fire a fire over a pool of fuel and/or water or other liquids.
primary containment the tanks, pipes and vessels that normally hold liquids, and
the devices fitted to them to allow them to be safely operated.
quantified risk analysis/assessment (QRA) a systematic analytical technique for
quantifying the risks associated with hazardous installations, based on assessing a
range of foreseeable failure scenarios. The risk to an individual at a specific
location is the summation of the risks arising from the different scenarios.
Regional Resilience Forum The Regional Resilience Forums are established by
each Government Office to discuss civil protection issues from the regional
perspective and to create a stronger link between local and central government on
resilience issues. Similar arrangements are made in the devolved administrations.
responder under the Civil Contingencies Act 2004, the Environment Agency is a
Category 1 responder, and HSE is a Category 2 responder. These categories define
the roles played by each body in response to a major incident.
risk the likelihood that a hazard will cause a specified harm to someone or
something.
safety integrity level (SIL) a safety integrity level (SIL) is a measure of safety
system performance, in terms of the probability of failure on demand. There are
four discreet integrity levels, SIL 14. The higher the SIL level, the higher the
associated safety level and the lower the probability that a system will fail to
perform properly.
87
safety reports the COMAH Regulations require operators of top-tier sites to
submit written safety reports to the Competent Authority.
secondary containment Enclosed areas around storage vessels (often called bunds),
created usually by concrete or earth walls. Their purpose is to hold any escaping
liquids and any water or chemicals used in firefighting.
Seveso II In 1976, a major accident occurred in Seveso, Italy, where the accidental
production and release of a dioxin as an unwanted by-product from a runaway
chemical reaction led to widespread contamination. A number of such incidents,
and the recognition of the differing standards of controls over industrial activities
within the European Community, led the European Commission to propose a
Directive on the control of major industrial accident hazards. The Directive on the
Major Accident Hazards of Certain Industrial Activities (82/501/EEC) was adopted
on 24 June 1982, and is generally known as the Seveso Directive. Following a
complete review of the Directive by the European Commission a new one, now
known as Seveso II, came into force on 3 February 1997 and was implemented in
Great Britain on 1 April 1999 by the Control of Major Accident Hazards
Regulations 1999, except for land use planning requirements, which were
implemented by changes to planning legislation.
tertiary containment the site surface and associated drainage, boundary walls,
roads, containment kerbs and any features such as road humps that can provide
some retention of liquids. Proper design of drainage systems will limit loss of
product out of the site and prevent lost product permeating into the ground with
the potential risk that it can migrate to groundwater, or contaminate surface
waters and land.
tier the COMAH Regulations apply where threshold quantities of dangerous
substances identified in the Regulations are kept or used. There are two thresholds,
known as lower-tier and top tier. Annex 1 gives a brief background to the
origins of these Regulations.
top-tier see tier.
88
Further information
Useful links
Buncefield Major Incident Investigation
Marlowe Room, Rose Court 2 Southwark Bridge London, SE1 9HS
Tel: 020 7717 6909
Fax: 020 7717 6082
E-mail: buncefield.inforequest@hse.gsi.gov.uk
Web: www.buncefieldinvestigation.gov.uk
Community/business support
Dacorum Business Contact Centre
Tel: 01442 867 805
Business Link Helpline Tel: 01727 813 813
Hertfordshire Chamber of Commerce
Tel: 01727 813 680
Dacorum Borough Council
Tel: 01442 228 000
Web: www.dacorum.gov.uk
Dacorum Community Trust
Tel: 01442 231396
Web: www.dctrust.org.uk
Hemel Hempstead Citizens Advice Bureau
19 Hillfield Road, Hemel Hempstead HP2 4AA
Tel: 01442 213368
Local authorities and emergency services
Dacorum Borough Council
Tel: 01442 228 000
Web: www.dacorum.gov.uk
Dacorum Community Trust
Tel: 01442 231 396
Web: www.dctrust.org.uk
St Albans District Council
Tel: 01727 866 100
Web: www.stalbans.gov.uk
Hertfordshire County Council
Tel: 01483 737 555
Web: www.hertsdirect.org
Hertfordshire Fire and Rescue Service
Web: www.hertsdirect.org/yrccouncil/hcc/fire/buncefield
Hertfordshire Constabulary
Web: www.herts.police.uk/news/buncefield/main.htm 89
90
Hertfordshire Chamber of Commerce
Tel: 01727 813 680
Web: www.hertschamber.com
Government links
Cabinet Office
Web: www.cabinetoffice.gov.uk
Communities and Local Government
Fire and Resilience Directorate
Web: www.communities.gov.uk
Government Office for the East of England
Web: www.goeast.gov.uk
Environment Agency
Web: www.environment-agency.gov.uk
Department for Business, Enterprise and Regulatory Reform
Oil and Gas Directorate
Web: www.og.berr.gov.uk
Health and Safety Executive
Hazardous Installations Directorate
Web: www.hse.gov.uk/hid
Control of Major Accident Hazards
Web: www.hse.gov.uk/comah
Department for the Environment, Food and Rural Affairs
Web: www.defra.gov.uk
Health Protection Agency
Web: www.hpa.org.uk
Food Standards Agency
Web: www.food.gov.uk
Drinking Water Inspectorate
Web: www.dwi.gov.uk
Scottish Environment Protection Agency
Web: www.sepa.org.uk
UK Resilience
Web: www.ukresilience.info
Scottish Executive Justice Department Civil Emergencies
Web: www.scotland.gov.uk/Topics/Justice/emergencies/guidance
Wales Local Resilience
Web: http://new.wales.gov.uk/resilience/regional-local-resilience1/?lang=en
Northern Ireland Central Emergency Planning Unit
Web: http://cepu.nics.gov.uk
91
Process Safety Leadership Group (replaced the Buncefield Standards Task Group)
Contact: colette.fitzpatrick@hse.gsi.gov.uk
National Recovery Working Group
Contact: Rhiannon.harries@communities.gsi.gov.uk
Industry links
United Kingdom Petroleum Industry Association (UKPIA)
Tel: 020 7240 0289
Web: www.ukpia.com
Chemical Industries Association
Tel: 020 7834 3399
Web: www.cia.org.uk
Three Valleys Water
Tel: 0845 782 3333
Web: www.3valleys.co.uk
United Kingdom Onshore Pipeline Operators Association (UKOPA) Tel: 01773
852003
Web: www.ukopa.co.uk
Tank Storage Association
Tel: 01244 335627
Web: www.tankstorage.org.uk
Investigation reports
Buncefield Major Incident Investigation:
Progress Report published 21 February 2006
Second Progress Report published 11 April 2006
Third Progress Report published 9 May 2006
Initial Report, published 13 July 2006
Recommendations on the design and operation of fuel storage sites published
29 March 2007
Recommendations on the emergency preparedness for, response to and
recovery from incidents published 17 July 2007
Explosion Mechanism Advisory Group report published 16 August 2007
Available from www.buncefieldinvestigation.gov.uk
DEFRA: Initial review of Air Quality aspects of the Buncefield Oil Depot
Explosion
Main report: http://www.defra.gov.uk/environment/airquality/publications/
buncefield/buncefield-report.pdf
Appendices: http://www.defra.gov.uk/environment/airquality/publications/
buncefield/buncefield-append.pdf
92
Buncefield: Hertfordshire Fire and Rescue Services review of the fire response
Hertfordshire Fire and Rescue Service, November 2006 ISBN 978 0 11 703716 8
Angus Fire, Buncefield Oil Terminal Incident December 2005: Review of part
played by Angus Fire and lessons learned
www.angusfire.co.uk
Other related reports/information
East of England Development Agency report by SQW, Economic Developments
Consultants on: The Buncefield Oil Depot Incident: Economic and Business
Confidence Impact Study, June 2006
www.eeda.org.uk
Swiss Fire Service: Quick Look Report Buncefield Fire 11 December 2005
Buncefield social impact report Dacorum Borough Council, January 2007
www.dacorum.gov.uk/default.aspx?page=4191
Contract research reports for HSE
WS Atkins Science and Technology: Derivation of fatality probability functions for
occupants of buildings subject to blast loads Phases 1, 2, & 3 147/1997 and Phase
4 151/1997
Biomedical Sciences Chemical and Biological Defence Sector Defence Evaluation
and Research Agency: Review of blast injury data and models 192/1998
Available from: www.hsebooks.com
Government Advisory Bodies
Committee on mutagenicity of chemicals in food, consumer products and the
environment (COM)
Committee on carcinogenicity of chemicals in food, consumer products and the
environment (COC)
Committee on toxicity of chemicals in food, consumer products and the
environment (COT)
www.advisorybodies.doh.gov.uk/coc/
Reprinted 08/08 C10
93 93 93